I found something similar to this a few years back[1], where the daemon would download and run anything if just “dell” was in the referring host. It seems they

I found something similar to this a few years back[1], where the daemon would download and run anything if just “dell” was in the referring host. It seems they have improved the security somewhat by using white lists, but their coding practices seem a bit shoddy. Why have an SDK token at all if it’s public and globally shared? I wouldn’t be surprised if a lot of the code was shared between the previous incarnation that I found an issue with and this pre-installed version. 1. https://tomforb.es/dell-system-detect-rce-vulnerability/ https://tomforb.es/dell-system-detect-rce-vulnerability/