CVE-2023-25535
📋 TL;DR
This vulnerability in Dell SupportAssist for Home PCs allows local attackers to escalate privileges during first-time installations. Only users who performed initial installations before March 8, 2023 are affected. The flaw enables attackers to gain higher system privileges than intended.
💻 Affected Systems
- Dell SupportAssist for Home PCs
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access could gain SYSTEM/administrator privileges, enabling complete system compromise, data theft, malware persistence, and lateral movement.
Likely Case
Malicious local users or malware could exploit this to bypass security controls, install additional malware, or access sensitive data.
If Mitigated
With proper access controls and monitoring, exploitation would be limited to authorized local users, reducing overall risk.
🎯 Exploit Status
Requires local access to the system and specific timing conditions (first-time installation before March 8, 2023).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.13.2.19 or later
Restart Required: No
Instructions:
1. Download the latest Dell SupportAssist installer from Dell's official website. 2. Run the installer to update to version 3.13.2.19 or later. 3. Verify the installation completed successfully.
🔧 Temporary Workarounds
Uninstall vulnerable version
windowsRemove Dell SupportAssist if not needed or if installation was before March 8, 2023
Control Panel > Programs > Uninstall a program > Select Dell SupportAssist > Uninstall
🧯 If You Can't Patch
- Restrict local access to systems with vulnerable installations
- Implement application whitelisting to prevent unauthorized privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check installation date: If Dell SupportAssist was first installed before March 8, 2023, check version in Control Panel > Programs.Check Version:
wmic product where name='Dell SupportAssist' get versionVerify Fix Applied:
Verify version is 3.13.2.19 or later in Control Panel > Programs > Dell SupportAssist properties.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing privilege escalation attempts
- Application logs showing Dell SupportAssist installation/update activity
Network Indicators:
- No network indicators - local vulnerability only
SIEM Query:
EventID=4688 AND ProcessName LIKE '%SupportAssist%' AND NewProcessName LIKE '%cmd%' OR '%powershell%'🔗 References
- https://www.dell.com/support/kbdoc/en-us/000211410/dell-supportassist-for-home-pcs-security-update-for-installer-executable-file-for-local-privilege-escalation-lpe-vulnerability
- https://www.dell.com/support/kbdoc/en-us/000211410/dell-supportassist-for-home-pcs-security-update-for-installer-executable-file-for-local-privilege-escalation-lpe-vulnerability
