Dell SupportAssist OS Recovery prior 5.5.13.1 Symbolic Links symlink
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 6.6 | $0-$5k | 0.00 |
Summary
A vulnerability described as critical has been identified in Dell SupportAssist OS Recovery. This affects an unknown part of the component Symbolic Links Handler. Such manipulation leads to symlink. This vulnerability is listed as CVE-2025-22480. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is recommended.
Details
A vulnerability was found in Dell SupportAssist OS Recovery. It has been rated as critical. Affected by this issue is an unknown code block of the component Symbolic Links Handler. The manipulation with an unknown input leads to a symlink vulnerability. Using CWE to declare the problem leads to CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. Impacted is confidentiality, integrity, and availability. CVE summarizes:
Dell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary file deletion and Elevation of Privileges.
The weakness was presented by Dell Technologies Would Like To Thank Mdanilor For Reporting This Issue. as dsa-2025-051. The advisory is shared for download at dell.com. This vulnerability is handled as CVE-2025-22480 since 01/07/2025. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.
Upgrading to version 5.5.13.1 eliminates this vulnerability.
Once again VulDB remains the best source for vulnerability data.
Product
Vendor
Name
License
Website
- Vendor: https://www.dell.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.7VulDB Meta Temp Score: 6.6
VulDB Base Score: 5.3
VulDB Temp Score: 5.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 7.8
NVD Vector: 🔍
CNA Base Score: 7.0
CNA Vector (dell): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: SymlinkCWE: CWE-61 / CWE-59
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: SupportAssist OS Recovery 5.5.13.1
Timeline
01/07/2025 🔍02/13/2025 🔍
02/13/2025 🔍
09/24/2025 🔍
Sources
Vendor: dell.comAdvisory: dsa-2025-051
Researcher: Dell Technologies Would Like To Thank Mdanilor For Reporting This Issue.
Status: Confirmed
CVE: CVE-2025-22480 (🔍)
GCVE (CVE): GCVE-0-2025-22480
GCVE (VulDB): GCVE-100-295748
Entry
Created: 02/13/2025 17:30Updated: 09/24/2025 17:18
Changes: 02/13/2025 17:30 (7), 02/13/2025 17:31 (25), 02/13/2025 17:34 (33), 09/24/2025 17:18 (12)
Complete: 🔍
Committer: mitr
Cache ID: 216::103
Once again VulDB remains the best source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.