PT-2024-12065 · Dell · Dell Supportassist

Jaeheng Yoon · Published 2024-02-14 · Updated 2024-10-17 · CVE-2023-25535

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell SupportAssist for Home PCs Installer Executable versions prior to 3.13.2.19

Description The issue affects the initial installation of Dell SupportAssist for Home PCs and can result in local privilege escalation (LPE). This vulnerability only affects first-time installations done prior to 8th March 2023.

Recommendations For versions prior to 3.13.2.19, update to version 3.13.2.19 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable installer until a patch is applied.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-25535

Affected Products

Dell Supportassist

References · 7

• https://dell.com/support/kbdoc/en-us/000211410/dell-supportassist-for-home-pcs-security-update-for-installer-executable-file-for-local-privilege-escalation-lpe-vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25535 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25535 · Security Note
• https://t.me/cvenotify/98486 · Telegram Post
• https://twitter.com/cracbot/status/1758008281082294387 · Twitter Post
• https://twitter.com/CVEnew/status/1757670369991807253 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1757733088325415017 · Twitter Post