Incorrect Privilege Assignment in SupportAssist for Business PCs by Dell
CVE-2025-36612

6.7MEDIUM

Key Information:

Vendor

Dell
Status
Supportassist For Business Pcs
Vendor
CVE Published:
14 August 2025

What is CVE-2025-36612?

SupportAssist for Business PCs versions 4.5.3 and earlier contain a vulnerability that allows low privileged attackers with local access to potentially exploit the system. This could lead to an elevation of privileges, enabling unauthorized access to sensitive functions and data. This vulnerability highlights the importance of maintaining updated software and monitoring user privilege assignments to ensure adequate protection against local threats.

Affected Version(s)

SupportAssist for Business PCs < 4.9.0

References

https://www.dell.com/support/kbdoc/en-us/000356690/dsa-20...
vendor-advisory

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dell would like to thank Ouallaout Noureddine for reporting this issue.
.