CVE-2019-3735: dell dell supportassist for business pcs Improper Privilege Management

Vulnerability summary

CVE-2019-3735 is a high (CVSS 7.8) Improper Privilege Management vulnerability in dell dell supportassist for business pcs. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.5% of scored vulnerabilities.

Timeline

1. 20-06-2019
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

Dell SupportAssist for Business PCs version 2.0 and Dell SupportAssist for Home PCs version 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, and 3.2.1 contain an Improper Privilege Management Vulnerability. A malicious local user can exploit this vulnerability by inheriting a system thread using a leaked thread handle to gain system privileges on the affected machine.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.