Published:2026/03/04  Last Updated:2026/03/04

JVN#56544509
Multiple vulnerabilities in Dell UPS Multi-UPS Management Console (MUMC)

Overview

UPS Multi-UPS Management Console (MUMC) provided by Dell Inc. contains multiple vulnerabilities.

Products Affected

  • UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03)
This issue was reported for the above version, which was released in January 2013.

Description

UPS Multi-UPS Management Console (MUMC) provided by Dell Inc. contains multiple vulnerabilities listed below.

  • Unquoted search path or element (CWE-428)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
    • CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 6.7
    • CVE-2026-26033
  • Incorrect default permissions (CWE-276)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.5
    • CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score 7.8
    • CVE-2026-26034

Impact

  • A user with write access to a directory on the system drive may execute arbitrary code with SYSTEM privileges (CVE-2026-26033)
  • Arbitrary code may be executed with SYSTEM privileges if the application loads a specially crafted DLL (CVE-2026-26034)

Solution

Stop Using End-of-Support Product
The affected product is no longer supported. It is recommended that users stop using the product.

Vendor Status

Vendor Link
Dell Inc. Dell UPS ULNM and MUMC Management Software - Release 3.0

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-26033
CVE-2026-26034
JVN iPedia JVNDB-2026-000032