CVE-2025-46370
Dell Alienware Command Center 6.0 – 6.10.15.0
Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:NSummary
CVE-2025-46370 is a low-severity Process Control (CWE-114) vulnerability in Dell Alienware Command Center. Its CVSS base score is 3.3 (Low).
Operationally, ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) and SC-39 (Process Isolation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-175358
Vulnerability Data
Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Process Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly counters CWE-114 Process Control by enforcing isolation between processes so a low-privileged local process cannot manipulate or inspect another process to cause information disclosure.
Limits the privileges granted to the AWCC process and its users, reducing the attack surface available to a low-privileged local attacker attempting to exploit process control.
Enforces access-control decisions on process resources and objects, blocking unauthorized local access that leads to the observed information disclosure.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicitly prevents execution of unauthorized software, directly blocking untrusted commands or libraries.
Assessing authenticity/integrity before acquisition reduces use of untrusted sources for commands/libraries.
Hardened configuration baselines can enforce trusted paths and execution policies.
Secure SDLC practices can embed checks against dynamic loading from untrusted sources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect unsafe process or library loading but does not prevent it by itself.
Restricting software installation prevents loading untrusted libraries or executing commands from unknown sources.
Secure development lifecycle practices include controls on external code and command execution paths.
Application security requirements can mandate validation of external inputs and libraries.
Secure architecture principles discourage reliance on untrusted external processes or libraries.
Secure coding standards explicitly forbid executing or loading code from untrusted sources.