CVE-2023-23696: 
Dell Command | Intel vPro Out of Band vulnerability analysis and mitigation

Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contains an Improper Authorization vulnerability identified as CVE-2023-23696. The vulnerability was discovered and disclosed in February 2023, affecting Dell Command Intel vPro Out of Band management software. This security flaw allows locally authenticated malicious users to write arbitrary files to the system (Dell Advisory).

The vulnerability is classified as an Improper Authorization issue (CWE-285) with a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Dell's assessment differs slightly with a CVSS score of 7.0 (High) and vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a higher attack complexity (NVD).

If exploited, this vulnerability allows a locally authenticated malicious user to write arbitrary files to the system, potentially leading to significant system compromise through unauthorized file operations (Dell Advisory).

The vulnerability requires local access and authenticated user privileges to exploit. The attack complexity is considered high according to Dell's assessment, which suggests that specific conditions need to be met for successful exploitation (Dell Advisory).

Dell has released version 4.4.0 of Dell Command Intel vPro Out of Band to address this vulnerability. Users are advised to upgrade to this version to mitigate the security risk (Dell Advisory).