PT-2019-16664 · Dell · Dell Supportassist Client

Bill Demirkapi · Published 2019-04-18 · Updated 2022-01-01 · CVE-2019-3719

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell SupportAssist Client versions prior to 3.2.0.90

Description The issue allows an unauthenticated attacker, sharing the network access layer with the vulnerable system, to compromise the system by tricking a victim user into downloading and executing arbitrary executables via the SupportAssist client from attacker-hosted sites. This vulnerability affects over 30 million devices, including 128 models of Dell desktops and laptops. Two of the vulnerabilities were fixed by Dell on the server side, while the other two require a client-side update.

Recommendations For Dell SupportAssist Client versions prior to 3.2.0.90, update to version 3.2.0.90 or later to resolve the issue. As a temporary workaround, consider disabling the BIOSConnect service to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2019-3719

Affected Products

Dell Supportassist Client

References · 6

• 🔥 https://github.com/jiansiting/CVE-2019-3719 · Exploit
• https://dell.com/support/article/us/en/19/sln316857/dsa-2019-051-dell-supportassist-client-multiple-vulnerabilities?lang=en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3719 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3719 · Security Note
• https://t.me/true_secator/1849 · Telegram Post
• https://t.me/cybersecuritytechnologies/510 · Telegram Post