CVE-2023-39249: dell supportassist_client_consumer

Vulnerability summary

CVE-2023-39249 is a medium (CVSS 6.3) vulnerability in dell supportassist_client_consumer. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.5% of scored vulnerabilities.

Timeline

1. 14-02-2024
   PublishedVulnerability first disclosed.
2. 14-08-2024
   Last modifiedVulnerability information updated.

Description

Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables IT/System Administrators to perform driver scans and Dell-recommended driver installations without requiring them to log out of the local non-admin user session. However, the granted privilege is limited solely to the SupportAssist User Interface and automatically expires after 15 minutes.

• CWE-280Improper Handling of Insufficient Permissions or PrivilegesThe product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.