6.3
Medium
CVE-2023-39249 Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows…
Description
Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables IT/System Administrators to perform driver scans and Dell-recommended driver installations without requiring them to log out of the local non-admin user session. However, the granted privilege is limited solely to the SupportAssist User Interface and automatically expires after 15 minutes.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SupportAssist Client Consumer | 3.4.0 | No fix stated |
Other CVEs of SupportAssist Client Consumer
The 10 CVEs of SupportAssist Client Consumer →
CVE-2023-25535
Dell SupportAssist for Home PCs Installer Executable file version prior to 3.13.2.19 used for initial installation has a…
7.2
High
CVE-2023-48670
Dell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation vulnerability in the…
7.3
High
CVE-2022-34386
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and…
5.5
Medium
CVE-2022-34385
SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior)…
5.5
Medium