CVE-2025-46636
📋 TL;DR
Dell Encryption versions before 11.12.1 contain a link following vulnerability that allows local low-privileged attackers to manipulate symbolic links or junctions to tamper with files they shouldn't have access to. This affects organizations using Dell Encryption for data protection on Windows systems.
💻 Affected Systems
- Dell Encryption
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker could tamper with critical system files, encryption keys, or configuration files, potentially disabling encryption or gaining unauthorized access to protected data.
Likely Case
Local user could modify application files, configuration, or logs to disrupt encryption operations or gain persistence.
If Mitigated
With proper access controls and monitoring, impact limited to isolated file tampering within user's permitted directories.
🎯 Exploit Status
Requires local access and knowledge of symbolic link manipulation techniques. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.12.1 or later
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000394657/dsa-2025-442
Restart Required: Yes
Instructions:
1. Download Dell Encryption 11.12.1 or later from Dell Support. 2. Backup encryption keys. 3. Install update with administrative privileges. 4. Restart system. 5. Verify encryption functionality.
🔧 Temporary Workarounds
Restrict Local Access
windowsLimit local user access to systems with Dell Encryption installed
Monitor Symbolic Link Creation
windowsEnable auditing for symbolic link and junction creation events
auditpol /set /subcategory:"File System" /success:enable /failure:enable
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges on affected systems.
- Deploy endpoint detection and response (EDR) to monitor for suspicious file manipulation activities.
🔍 How to Verify
Check if Vulnerable:
Check Dell Encryption version in Control Panel > Programs and Features or via command: wmic product where "name like 'Dell Encryption%'" get versionCheck Version:
wmic product where "name like 'Dell Encryption%'" get versionVerify Fix Applied:
Verify version is 11.12.1 or higher using same method as checking vulnerability📡 Detection & Monitoring
Log Indicators:
- Windows Security event logs showing symbolic link creation (Event ID 4656)
- Application logs showing unexpected file access by Dell Encryption processes
Network Indicators:
- No network indicators - local attack only
SIEM Query:
source="windows_security" AND event_id=4656 AND object_name="*\Dell\Encryption\*"