Dell SupportAssist for Business PCs up to 4.8.x privileges assignment
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 7.1 | $0-$5k | 0.00 |
Summary
A vulnerability classified as critical has been found in Dell SupportAssist for Business PCs up to 4.8.x. Affected is an unknown function. The manipulation leads to privileges assignment. This vulnerability is referenced as CVE-2025-36612. The attack can only be performed from a local environment. No exploit is available. It is recommended to upgrade the affected component.
Details
A vulnerability was found in Dell SupportAssist for Business PCs up to 4.8.x. It has been rated as critical. This issue affects some unknown processing. The manipulation with an unknown input leads to a privileges assignment vulnerability. Using CWE to declare the problem leads to CWE-266. A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:
SupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
The weakness was published by Ouallaout Noureddine as dsa-2025-296. The advisory is shared at dell.com. The identification of this vulnerability is CVE-2025-36612 since 04/15/2025. The exploitation is known to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/19/2025). MITRE ATT&CK project uses the attack technique T1068 for this issue.
Upgrading to version 4.9.0 eliminates this vulnerability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Product
Vendor
Name
Version
License
Website
- Vendor: https://www.dell.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔒VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.2VulDB Meta Temp Score: 7.1
VulDB Base Score: 7.0
VulDB Temp Score: 6.7
VulDB Vector: 🔒
VulDB Reliability: 🔍
NVD Base Score: 7.8
NVD Vector: 🔒
CNA Base Score: 6.7
CNA Vector (dell): 🔒
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Privileges assignmentCWE: CWE-266
CAPEC: 🔒
ATT&CK: 🔒
Physical: Partially
Local: Yes
Remote: Partially
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔒
Upgrade: SupportAssist for Business PCs 4.9.0
Timeline
04/15/2025 CVE reserved08/14/2025 Advisory disclosed
08/14/2025 VulDB entry created
08/19/2025 VulDB entry last update
Sources
Vendor: dell.comAdvisory: dsa-2025-296
Researcher: Ouallaout Noureddine
Status: Confirmed
CVE: CVE-2025-36612 (🔒)
GCVE (CVE): GCVE-0-2025-36612
GCVE (VulDB): GCVE-100-320165
Entry
Created: 08/14/2025 17:50Updated: 08/19/2025 01:09
Changes: 08/14/2025 17:50 (64), 08/19/2025 01:09 (12)
Complete: 🔍
Cache ID: 216::103
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
No comments yet. Languages: en.
Please log in to comment.