CVE-2023-28066
📋 TL;DR
This vulnerability in Dell OS Recovery Tool allows local authenticated non-administrator users to elevate their privileges on the system. It affects versions 2.2.4013 and 2.3.7012.0 of the tool, potentially enabling attackers to gain administrative access.
💻 Affected Systems
- Dell OS Recovery Tool
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full administrative control of the system, allowing installation of malware, data theft, or complete system compromise.
Likely Case
Local users with standard privileges gain administrative access to install unauthorized software or modify system configurations.
If Mitigated
With proper access controls and least privilege principles, impact is limited to users who already have local authenticated access.
🎯 Exploit Status
Exploitation requires local authenticated access but no special privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest version (2.3.7012.0 or later with patches applied)
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000212575/dsa-2023-147
Restart Required: Yes
Instructions:
1. Download latest Dell OS Recovery Tool from Dell support site. 2. Uninstall current version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Remove Dell OS Recovery Tool
windowsUninstall the vulnerable software if not needed
Control Panel > Programs > Uninstall a program > Select Dell OS Recovery Tool > Uninstall
Restrict local user access
allLimit which users have local access to systems with vulnerable software
🧯 If You Can't Patch
- Remove Dell OS Recovery Tool from all systems if not required
- Implement strict access controls and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Dell OS Recovery Tool version in Control Panel > Programs > Programs and FeaturesCheck Version:
wmic product where name="Dell OS Recovery Tool" get versionVerify Fix Applied:
Verify installed version is newer than 2.3.7012.0 or has been removed📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Dell OS Recovery Tool process execution with elevated privileges
Network Indicators:
- None - local vulnerability only
SIEM Query:
EventID=4688 AND ProcessName="*Dell*OS*Recovery*" AND NewProcessName contains "cmd.exe" OR "powershell.exe"