CVE-2022-34384: dell alienware_update Execution with Unnecessary Privileges

Vulnerability summary

CVE-2022-34384 is a high (CVSS 7.8) Execution with Unnecessary Privileges vulnerability in dell alienware_update. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.9% of scored vulnerabilities.

Timeline

1. 10-02-2023
   PublishedVulnerability first disclosed.
2. 26-03-2025
   Last modifiedVulnerability information updated.

Description

Dell SupportAssist Client Consumer (version 3.11.1 and prior), SupportAssist Client Commercial (version 3.2 and prior), Dell Command | Update, Dell Update, and Alienware Update versions before 4.5 contain a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user may potentially exploit this vulnerability, leading to privilege escalation.

• CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.