Dell · dbutil Driver
CVE-2021-21551
Dell dbutil Driver Insufficient Access Control Vulnerability
What it is
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.
CISA: Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 21, 2022
- Added to the CISA list
- March 31, 2022
- Published
- May 4, 2021
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 80% in the top 0.4% of all known vulnerabilities
- Weakness
- CWE-782
- More details
- NVD · CVE.org · CISA
All references (3)
- https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell…
- http://packetstormsecurity.com/files/162604/Dell-DBUtil_2_3.sys-IOCTL-Memory-Read-Write.html
- http://packetstormsecurity.com/files/162739/DELL-dbutil_2_3.sys-2.3-Arbitrary-Write-Privilege-Escalation.html
More exploited flaws from Dell
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 18, 2026 | Use of Hard-coded Credentials | RecoverPoint for Virtual Machines (RP4VMs) | Critical 10.0 | 14% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.