New Dell System Update flaw lets hackers gain root privileges

CVE-2021-21551 is an insufficient access control flaw (CWE-782) in Dell's dbutil_2_3.sys driver, present on Dell systems for roughly 12 years before being patched. A local, authenticated user can trigger the flaw by sending crafted requests (IOCTLs) to the driver, gaining the ability to read and write arbitrary memory. An attacker who exploits it can escalate privileges (typically to kernel/SYSTEM level), cause a denial of service, or disclose information, making it a useful stepping stone for post-compromise attacks. Any Dell machine that shipped or ran the dbutil driver — used in Dell support and BIOS/BIOS-update tooling — is affected, and public reporting indicates hundreds of millions of Dell PCs are exposed. The flaw is actively exploited: it is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-03-31), public PoCs exist, and the Lazarus APT reportedly used it in attacks to deploy a rootkit; EPSS puts the 30-day exploitation probability at 79.2%.

Do: Apply Dell's updated driver/firmware per vendor instructions, as required by CISA's KEV catalog. Inventory your fleet for the dbutil_2_3.sys driver file (commonly found with Dell support tools and BIOS update utilities) and prioritize patching endpoints, since the bug requires only local user access. Hunt for signs of local privilege-escalation activity consistent with public PoCs, given documented Lazarus APT use to deploy a rootkit.

Dell RecoverPoint for Virtual Machines (RP4VMs) versions prior to 6.0.3.1 HF1 contain hard-coded credentials (CWE-798) for the appliance's underlying operating system. An unauthenticated remote attacker who knows the hard-coded credential can authenticate over the network with no user interaction and gain root-level access and persistence on the underlying OS — beyond just the RecoverPoint application — which is why the flaw scores a maximum CVSS of 10.0 with scope changed. Any organization running an affected RP4VMs release is exposed, with risk highest where appliance management interfaces are reachable from broader networks. The vulnerability is confirmed exploited in the wild: it was added to CISA's KEV catalog on 2026-02-18, and reporting indicates China-linked actors exploited it as a zero-day since at least 2024, prompting an emergency federal patch directive; related coverage ties the activity to the China-linked VerdantBamboo actor deploying BRICKSTORM-family backdoors on appliances.

Do: Upgrade all RP4VMs appliances to 6.0.3.1 HF1 or apply Dell's published remediations immediately — federal agencies must patch per BOD 22-01 by the KEV deadline (reported as 'by Saturday'). Because exploitation has occurred since at least 2024, treat deployed appliances as potentially compromised: review the underlying OS for unexpected accounts, modified services, and root persistence, and restrict the appliance's management/replication network reachability until patched.

Dell Container Storage Modules (CSM) before v1.18.0 ships a csm-authorization-storage gRPC server that fails to authenticate callers on a critical function (CWE-306). An unauthenticated remote attacker who can reach the gRPC endpoint can invoke that function and retrieve the storage backend administrator credentials for every storage array registered with the CSM Authorization module. Because those credentials typically grant full administrative control of the underlying storage systems, the flaw can cascade into complete compromise of storage and, by extension, the Kubernetes workloads depending on it. The bug scores a perfect CVSS 3.1 of 10.0 (network, low complexity, no privileges or user interaction, scope change, high impact to confidentiality, integrity, and availability). Dell has patched the issue and is urging admins to apply updates promptly, but there is no known public PoC and no confirmed in-the-wild exploitation, and it is not yet on the CISA KEV list.

Do: Upgrade Dell CSM to v1.18.0 or later immediately, prioritizing any cluster running the CSM Authorization module. Until patched, restrict network access to the csm-authorization-storage gRPC server (e.g., Kubernetes NetworkPolicies and firewall rules limiting reachability to trusted pods/segments only) and verify it is not exposed outside the cluster. After patching, rotate the administrator credentials for all registered storage arrays and audit logs for unexplained gRPC calls or suspicious storage-array logins, since the credentials could have been silently harvested before the fix.

Dell System Update (DSU) versions prior to 2.3.0.0 contain a path traversal flaw (CWE-22) that lets an unauthenticated remote attacker break out of a restricted directory and gain filesystem access on the host. The CVSS 3.1 vector (AV:N/PR:N/UI:R) indicates exploitation is network-reachable and needs no credentials, but does require some user interaction, suggesting a crafted request or link that tricks an administrator session into triggering the malicious path. Successful exploitation allows the attacker to write or access files outside the intended directory, ultimately enabling arbitrary code execution with root privileges and full compromise of the application and underlying operating system. The flaw affects Dell servers (typically PowerEdge running Linux) where DSU is installed and its interface is reachable by the attacker. No public proof-of-concept exists, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been reported; Dell has issued a fix and urges immediate upgrade.

Do: Upgrade Dell System Update to version 2.3.0.0 or later on every server where it is installed. Restrict DSU's network interface to trusted management networks and VPNs so unauthenticated remote requests cannot reach it, and train admins not to browse untrusted sites while a DSU session is active given the user-interaction requirement in the CVSS vector. On patched-but-previously-exposed hosts, review for signs of prior abuse such as unexpected files written via traversal paths, unfamiliar root-owned binaries, cron jobs, or new SUID files.