Dell Supportassist vulnerabilities

6 vulnerabilities

Known vulnerabilities in Dell Supportassist, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.8CVE-2022-34387dellsupportassist+2
EPSS score
0.15%
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilege escalation vulnerability. A local authenticated malicious user could potentially exploit this vulnerability to elevate privileges and gain total control of the system.5.3CVE-2022-34389dellsupportassist+2
EPSS score
0.44%
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vulnerability and impersonate a legitimate dell customer to a dell support technician.7.1CVE-2022-34388dellsupportassist+2
EPSS score
0.16%
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and  SupportAssist for Business PCs (version 3.2.0 and prior) contain information disclosure vulnerability. A local malicious user with low privileges could exploit this vulnerability to view and modify sensitive information in the database of the affected application.5.5CVE-2022-34392dellsupportassist+1
EPSS score
0.16%
SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An authenticated non-admin user can be able to obtain the refresh token and that leads to reuse the access token and fetch sensitive information.8.8CVE-2019-3718dellsupportassist+1
EPSS score
0.67%
Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.8CVE-2019-3719dellsupportassist+1
EPSS score
16.27%
Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.