CVE-2025-43991: dell supportassist_for_business_pcs UNIX Symbolic Link (Symlink) Following

Vulnerability summary

CVE-2025-43991 is a high (CVSS 7.1) UNIX Symbolic Link (Symlink) Following vulnerability in dell supportassist_for_business_pcs. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.3% of scored vulnerabilities.

Timeline

1. 13-10-2025
   PublishedVulnerability first disclosed.
2. 14-10-2025
   Last modifiedVulnerability information updated.

Description

SupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain an UNIX Symbolic Link (Symlink) following vulnerability. A low privileged attacker with local access to the system could potentially exploit this vulnerability to delete arbitrary files only in that affected system.

• CWE-61UNIX Symbolic Link (Symlink) FollowingThe product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.