CVE-2023-23697: 
Dell Command | Intel vPro Out of Band vulnerability analysis and mitigation

Dell Command | Intel vPro Out of Band, versions before 4.4.0, contains an arbitrary folder delete vulnerability (CVE-2023-23697) that was discovered and disclosed in February 2023. The vulnerability affects the software's uninstallation process and could potentially be exploited by locally authenticated users (Dell Advisory).

The vulnerability is classified as a folder deletion issue during the uninstallation process. It has been assigned a CVSS v3.1 base score of 4.7 (Medium) by Dell with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, while NVD assigned a score of 3.3 (Low) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is categorized under CWE-59 (Improper Link Resolution Before File Access) and CWE-1386 (Insecure Operation on Windows Junction / Mount Point) (NVD).

If exploited, this vulnerability could allow a locally authenticated malicious user to perform arbitrary folder deletion on the affected system during the uninstallation process of Dell Command | Intel vPro Out of Band (Dell Advisory).

The vulnerability requires local access and authenticated user privileges to exploit. The attack complexity is considered high according to Dell's assessment, indicating that specific conditions need to be met for successful exploitation (Dell Advisory).

Dell has released version 4.4.0 of Dell Command | Intel vPro Out of Band to address this vulnerability. Users are advised to upgrade to this version to mitigate the risk (Dell Advisory).

Dell Technologies acknowledged the security researcher ycdxsb for reporting this vulnerability (Dell Advisory).