How severe is CVE-2018-15766?

CVE-2018-15766 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2018-15766 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-15766?

CVE-2018-15766 primarily affects Dell Encryption. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2018-15766?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2018-15766 published?

CVE-2018-15766 was published on 2018-10-11 and last updated on 2026-06-17.

CVE-2018-15766

CVE-2018-15766 is a high-severity vulnerability in Dell Encryption with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-521.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 1% (42nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-521
Affected product: Dell Encryption
Published: 2018-10-11
Last modified: 2026-06-17

Description

On install, Dell Encryption versions prior 10.0.1 and Dell Endpoint Security Suite Enterprise versions prior 2.0.1 will overwrite and manually set the "Minimum Password Length" group policy object to a value of 1 on that device. This allows for users to bypass any existing policy for password length and potentially create insecure password on their device. This value is defined during the installation of the "Encryption Management Agent" or "EMAgent" application. There are no other known values modified.

Frequently asked questions

What is CVE-2018-15766?: On install, Dell Encryption versions prior 10.0.1 and Dell Endpoint Security Suite Enterprise versions prior 2.0.1 will overwrite and manually set the "Minimum Password Length" group policy object to a value of 1 on that device. This allows for users to bypass any existing policy for password length and potentially create insecure password on their device. This value is defined during the installation of the "Encryption Management Agent" or "EMAgent" application. There are no other known values modified.
How severe is CVE-2018-15766?: CVE-2018-15766 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2018-15766 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-15766?: CVE-2018-15766 primarily affects Dell Encryption. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2018-15766?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2018-15766 published?: CVE-2018-15766 was published on 2018-10-11 and last updated on 2026-06-17.

References

https://www.dell.com/support/article/us/en/04/sln313561/dell-encryption-and-dell-endpoint-security-suite-enterprise-security-policy-overwrite-vulnerability?lang=en

Affected products (2)

cpe:2.3:a:dell:encryption:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:endpoint_security_suite_enterprise:*:*:*:*:*:*:*:*

More vulnerabilities in Dell Encryption

CVE-2025-36564 — High (CVSS 7.8): Dell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution vulnerability. A local…
CVE-2025-46637 — High (CVSS 7.3): Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following')…
CVE-2025-36611 — High (CVSS 7.3): Dell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an Improper Link Resolution…
CVE-2019-3745 — High (CVSS 7.3): The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint…
CVE-2023-32479 — Medium (CVSS 6.7): Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0…
CVE-2020-5385 — Medium (CVSS 6.7): Dell Encryption versions prior to 10.8 and Dell Endpoint Security Suite versions prior to 2.8 contain a privilege…

All CVEs affecting Dell Encryption →

Other CWE-521 (Weak Password Requirements) vulnerabilities

CVE-2026-25715 — Critical (CVSS 9.8): The web management interface of the device allows the administrator username and password to be set to blank values.…
CVE-2025-53963 — Critical (CVSS 9.8): An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible…
CVE-2025-63747 — Critical (CVSS 9.8): QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit…
CVE-2025-12552 — Critical (CVSS 9.8): Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-11200 — Critical (CVSS 9.8): MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to…
CVE-2025-12364 — Critical (CVSS 9.8): Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Browse all CWE-521 (Weak Password Requirements) vulnerabilities →