Dell Command Update installing end of life version of .NET (dotnet) 7?

Question

Hello,

I am wondering if anyone can confirm that Dell Command Universal Update (v5.3) has been installing Microsoft .NET version 7? While it doesn't appear on the initial install of Dell Command, it does show up after running updates through the program.

I have tried circumventing this by installing a supported version of .NET 8 prior to running Dell Command, but it just installs version 7 in tandem with 8. Version 7 is starting to show up on security vulnerability scans and I would like to avoid installing it while still being able to use Dell Command if possible.

Thanks.

splat.user · Answer

Were you able to resolve this?  I am seeing this in our environment as well.  .NET 7.0.7 is being installed and flagging reports.

DS1234567 · Answer

@splat.user​ No, I have not been able to resolve this. I am hoping it is addressed in a future update.

AuldMS · Answer

Any update to this issue?  We are seeing the same results now and showing up in the security scans.

joelnorris-trh · Answer

I have believed this was happening for a long while but couldn't prove it. Our software inventory has recently shown that Dell Command Update 5.4.0 has been installed at the exact same time as dot net 7, so much pretty confirms my suspicions.

We use a vulnerability scanner which tells us about obsolete and vulnerable software for remediation, and dot net is constantly the worst offender.

fokker4u · Answer

We have the same security concerns.  DCU is not installing the .Net components, it's the Intel UHD Video driver that's installing .Net Runtime/ASP.net 7.0.20.

badingb · Answer

Default installed programs should be limited per NIST 800-53, many of Dell's programs install out of date dot net, that present a breach landscape. It's recommended to remove all Dell pre-installed programs and update your systems.

IfokIT · Answer

Just found this thread while searching for for a way to get rid of outdated .NET runtime versions. We only install the current version of DCU (5.6.0 UWP app) which itself requires .NET 8 runtime but the DELL Core Services that are installed alongside DCU mostly still require .NET 6 runtime which is EoS and has been since November 2024 !?!

.NET 8 (LTS) has been available for more than two years and even the next LTS release .NET 10 has been released last month. What is DELL doing (or not doing)!?

user_0e4a7b · Answer

I transitioned my services to IBM who also removes all Dell preinstalled programs and vulnerable .net versions. You’d think after Dell’s triple breach that they would get serious but also why most experts left cybersecurity. No one cares https://www.google.com/search?q=dells+triple+breach&ie=UTF-8&oe=UTF-8&hl=en-us&client=safari

Windows General

Dell Command Update installing end of life version of .NET (dotnet) 7?

Was this post helpful?