CVE-2022-29094 in SupportAssist Client Consumer
Summary
by MITRE • 06/11/2022
Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an arbitrary file deletion/overwrite vulnerability. Authenticated non-admin user could exploit the issue and delete or overwrite arbitrary files on the system.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/05/2026
The vulnerability identified as CVE-2022-29094 affects Dell SupportAssist Client software across both consumer and commercial variants, specifically targeting versions 3.10.4 and earlier for consumer editions, and 3.1.1 and earlier for commercial editions. This flaw represents a critical security weakness that allows authenticated users with non-administrator privileges to execute arbitrary file deletion or overwrite operations on affected systems. The vulnerability stems from insufficient input validation and access control mechanisms within the SupportAssist Client application, creating an exploitable condition that undermines the principle of least privilege and system integrity.
The technical implementation of this vulnerability lies in the improper handling of file operations within the application's file management subsystem. When an authenticated user interacts with certain functions of the SupportAssist Client, the software fails to properly validate file paths or implement adequate access controls before performing file manipulation operations. This weakness enables an attacker to craft malicious inputs or exploit specific application workflows that result in unauthorized file system modifications. The vulnerability is classified under CWE-22, which specifically addresses "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", and potentially CWE-73, "External Control of File Name or Path", depending on the exact implementation details. The flaw operates at the application layer, requiring authentication but not administrative privileges, making it particularly concerning for environments where users may have legitimate access to the system but should not be able to perform destructive file operations.
From an operational perspective, the impact of this vulnerability extends beyond simple data loss to encompass potential system compromise and business disruption. An authenticated non-admin user could leverage this vulnerability to delete critical system files, overwrite configuration files, or remove security-related components that could lead to system instability or complete system failure. The attack surface is particularly concerning in enterprise environments where multiple users may have access to support tools but should not possess destructive capabilities. The vulnerability creates a potential escalation path for attackers who may initially gain access through social engineering or credential compromise, then use this flaw to further compromise the system. According to the MITRE ATT&CK framework, this vulnerability relates to T1485, "Data Destruction", and T1059, "Command and Scripting Interpreter", as it enables an attacker to modify or delete system files through legitimate application interfaces.
The mitigation strategies for CVE-2022-29094 should prioritize immediate remediation through official Dell patches and updates. Organizations must ensure that all affected Dell SupportAssist Client installations are upgraded to versions that address this vulnerability, with particular attention to the specific version numbers mentioned in the CVE description. Additionally, system administrators should implement least privilege access controls to limit user permissions and reduce the attack surface. Network segmentation and monitoring of SupportAssist Client activities can help detect anomalous file deletion patterns. Regular security assessments should include verification that the patched versions are properly deployed and that no legacy versions remain active. The vulnerability highlights the importance of maintaining up-to-date security patches and the need for comprehensive vulnerability management programs that address both known and emerging threats in enterprise support software ecosystems.