CVE-2026-49810

Executive Summary

CVE-2026-49810 is a sensitive information disclosure vulnerability (CWE-532 — Insertion of Sensitive Information into Log File) in Dell Command | PowerShell Provider (DCPP) in versions prior to 2.10.2. A low-privileged attacker with local access could exploit the flaw to cause disclosure of information, which Dell/NVD classify with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8). Affected systems are Dell endpoints and administrative workstations where DCPP is installed and its logs are generated and readable by low-privilege users.

Technical Analysis

Dell Command | PowerShell Provider (DCPP) is a Dell management component that exposes BIOS/firmware configuration operations through a PowerShell provider interface. The CVE description states that versions prior to 2.10.2 contain an "Insertion of Sensitive Information into Log File" vulnerability (CWE-532). The core defect class is that sensitive data is written into a log file where it should not be, and that file is subsequently accessible to a principal that should not be able to read it.

Two properties combine to create the exposure:

1. Sensitive data enters the log. During normal operation, DCPP records diagnostic/operational information. Because of the CWE-532 defect, that recorded content includes sensitive values that the application has legitimate access to — for example authentication material, tokens, credentials, or other confidential configuration data that the provider handles at runtime. The exact fields are not enumerated in the NVD description, so the precise set of leaked values cannot be authoritatively stated here.
2. The log is reachable by a low-privileged local user. The CVSS vector (AV:L/PR:L) confirms the attacker only needs local access and low privileges. An unprivileged local user, or any process running in that user's context, can read the log artifact and extract the sensitive content.

Attack surface: the local filesystem, specifically wherever DCPP writes its log output. The vulnerability is not remotely triggerable (AV:L) and requires no user interaction from the victim (UI:N). Dell's classification of C:H/I:H/A:H is notable for a log-disclosure flaw: NVD/Dell assessed that the leaked content can drive high confidentiality loss (the sensitive data itself), high integrity loss (the leaked material may be usable to modify systems or data), and high availability loss (e.g., if leaked credentials permit disruptive actions). The single-scope (S:U) rating means the impact stays within the security authority of the vulnerable component.

Because the NVD entry provides no function names, file paths, log filenames, or parameter names, no code-level claim about where the write occurs or how it is triggered can be made with confidence. What is certain from the description and vector is: local access, low privilege, log-based disclosure, no user interaction.

Exploitation Scenarios

No public PoC or exploit code is available. The chain below is inferred strictly from the vulnerability class (CWE-532) and the CVSS vector (AV:L/AC:L/PR:L/UI:N); it deliberately avoids naming any implementation artifact not present in the NVD description.

1. Reconnaissance / target identification. The attacker obtains local access to a Dell endpoint or administrative workstation with DCPP prior to 2.10.2 installed. Access can be as ordinary as a standard, non-administrative user account — for example a shared workstation account, a contractor account, or an account obtained through unrelated low-severity footholds. The attacker confirms DCPP is present by inspecting installed software, the PowerShell provider registration, or management tooling present on the host. No remote scanning is required because the vector is local.

2. Triggering the flaw class. The flaw is a log-injection-of-sensitive-data issue. The sensitive values enter the log when DCPP performs operations that cause it to record the relevant data. Prior to exploitation, the attacker (or even normal administrative activity on the machine) may already have caused such entries to be written; alternatively the attacker can perform benign DCPP operations available to their privilege level to cause additional logging. The attacker is not required to break any cryptographic control — the defect is that logging records data it should have redacted or protected.

3. Access / harvesting method. Because the attacker already has local low-privilege access, the "exploitation" step is largely read access: locating and reading the DCPP log file(s) written to disk. The attacker searches common application and management log locations and the DCPP installation's log output for the sensitive values. This is a local file-read operation, not an injection, overflow, or remote code execution. The low PR:L rating reflects that no elevated privilege is needed to reach the artifact once permissions are as shipped.

4. Post-exploitation impact. Extracted sensitive content (e.g., credentials, tokens, or confidential configuration values captured in the log) can be used for lateral movement, privilege escalation, persistence, or exfiltration depending on what the leaked material authenticates to or configures. This is consistent with the C:H/I:H/A:H assessment. The attacker may also simply exfiltrate the sensitive configuration data for intelligence value, especially on administrator workstations where DCPP is used to manage fleets of Dell systems.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Scope is limited to hosts running DCPP versions prior to 2.10.2 (AV:L). Business impact is concentrated on Dell endpoint estates and the administrative workstations used to manage them. Blast radius per host is the confidentiality of whatever sensitive values DCPP logs, plus downstream integrity/availability impact if those values are credentials or configuration secrets usable elsewhere. CVSS subscores: confidentiality High (the sensitive data is disclosed), integrity High (leaked material may be usable to alter systems/data), availability High (leaked credentials or management access could enable disruptive actions), all within a single security scope (S:U). Privileges required are Low and no user interaction is needed. Because the CVSS base is 7.8 and the vector is local, the practical risk scales with how widely DCPP is deployed and how many low-privilege users can read log files on those systems; administrative workstations often represent a higher-value concentration point than end-user laptops.

Detection Guidance

Sigma Rule

title: Potential DCPP Sensitive Information Disclosure via Log Access
id: 3f9c1a54-7b2e-4d1a-9c6e-dcpp49810a01
status: experimental
description: Detects local low-privileged access to Dell Command | PowerShell Provider log files consistent with CVE-2026-49810 (CWE-532 sensitive data in log file).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-49810
author: valtersit.com
date: 2026/01/01
tags:
  - attack.collection
  - attack.t1005
  - cve.2026.49810
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\cmd.exe'
      - '\\wevtutil.exe'
      - '\\findstr.exe'
  selection_keywords:
    CommandLine|contains:
      - 'DCPP'
      - 'Dell.Command'
      - 'PowerShell Provider'
      - 'DCIM'
  selection_read:
    CommandLine|contains:
      - 'Get-Content'
      - 'type '
      - 'findstr'
      - 'Select-String'
      - 'copy '
      - 'Copy-Item'
  condition: selection_tools and selection_keywords and selection_read
falsepositives:
  - Legitimate Dell management and support activity
  - Administrative log collection
level: medium

YARA Rule

rule CVE_2026_49810_DCPP_Sensitive_Log_Exposure
{
    meta:
        description = "Detects DCPP log files containing potential sensitive material related to CVE-2026-49810 (CWE-532)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-49810"
        date = "2026-01-01"
        severity = "high"

    strings:
        $dcpp1 = "Command | PowerShell Provider" ascii wide nocase
        $dcpp2 = "DCPP" ascii wide nocase
        $log1  = "Password" ascii wide nocase
        $log2  = "Token" ascii wide nocase
        $log3  = "Secret" ascii wide nocase
        $log4  = "Credential" ascii wide nocase
        $log5  = "Auth" ascii wide nocase

    condition:
        filesize < 50MB and
        any of ($dcpp*) and
        any of ($log*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-49810 Dell Command PowerShell Provider log disclosure activity (user-agent match)"; flow:to_server,established; http.user_agent; content:"DCPP"; nocase; classtype:attempted-recon; reference:cve,2026-49810; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-49810; sid:1200264981; rev:1;)
# NOTE: This CVE is local-only (AV:L); the rule above only correlates management/telemetry
# network flows that reference DCPP. Primary detection is host-based (Sigma/Wazuh/EQL).

Elastic Detection

process where event.type == "start" and
  process.name in ("powershell.exe", "pwsh.exe", "cmd.exe", "findstr.exe") and
  process.command_line : ("DCPP*", "*Dell.Command*", "*PowerShell Provider*") and
  process.command_line : ("*Get-Content*", "*Select-String*", "*findstr*", "*Copy-Item*", "*type*")

Splunk SPL Query

index=windows (EventCode=4688 OR source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| search (New_Process_Name IN ("*\\powershell.exe","*\\pwsh.exe","*\\cmd.exe","*\\findstr.exe"))
| search (CommandLine="*DCPP*" OR CommandLine="*Dell.Command*" OR CommandLine="*PowerShell Provider*")
| search (CommandLine="*Get-Content*" OR CommandLine="*Select-String*" OR CommandLine="*findstr*" OR CommandLine="*Copy-Item*" OR CommandLine="*type *")
| table _time host User CommandLine ParentCommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="windows,dcpp,cve_2026_49810,">
  <rule id="100810" level="10">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.commandLine">DCPP|Dell\.Command|PowerShell Provider</field>
    <field name="win.eventdata.commandLine">Get-Content|Select-String|findstr|Copy-Item|type </field>
    <description>CVE-2026-49810: Possible local access to Dell Command | PowerShell Provider logs by low-privileged user</description>
    <mitre>
      <id>T1005</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict filesystem permissions on DCPP log locations so that low-privilege local users cannot read them; grant read access only to administrators and the service/account that writes the logs.
   • Audit and reduce low-privilege local accounts on Dell endpoints and management workstations where DCPP prior to 2.10.2 is installed.
   • Where feasible, temporarily disable or reduce DCPP diagnostic/verbose logging to limit the volume of sensitive data written, until a fixed version is confirmed.
   • Monitor for local reads of DCPP logs by non-administrative users (see detection rules above).

2. Patch / upgrade steps

   • NVD lists the fixed version as 2.10.2. Confirm the availability, release notes, and integrity of Dell Command | PowerShell Provider 2.10.2 (or later) directly from Dell's official support portal before deployment.
   • Given patch confidence is 0/4 and no patch source, vendor fix link, affected-version table, or workaround is recorded in this dataset, treat the fix as unverified. Do not assume an upgrade path exists without checking Dell's current advisory.
   • After upgrading, rotate any credentials or secrets that may have been written to DCPP logs on affected hosts.

3. Long-term hardening

   • Adopt a logging policy that requires redaction of sensitive fields before they are written to disk.
   • Apply least-privilege file permissions to all management-tool log directories by default.
   • Subscribe to Dell security advisories and to CISA KEV to track KEV listing and in-the-wild exploitation status for this CVE (currently not listed in KEV).

References

• NVD — CVE-2026-49810: https://nvd.nist.gov/vuln/detail/CVE-2026-49810
• Dell Security Advisories (vendor advisory portal): https://www.dell.com/support/security
• CWE-532 — Insertion of Sensitive Information into Log File: https://cwe.mitre.org/data/definitions/532.html
• CISA Known Exploited Vulnerabilities Catalog (check current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (score not yet assigned at time of writing): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence have been recorded for this CVE. CISA KEV status: NOT listed. No public PoC, Nuclei template, or exploit code is available.