CVE-2023-25535

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Dell SupportAssist for Home PCs Installer Executable file version prior to 3.13.2.19 used for initial installation has a high vulnerability that can result in local privilege escalation (LPE). This vulnerability only affects first-time installations done prior to 8th March 2023

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Dell	SupportAssist Client Consumer	< 3.13.2.19
dell	supportassist_client_consumer	< 3.13.2.19

References

Timeline

Published: Feb 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-255366.7Dell PowerScale OneFS 9.4.0.x contains exposure of sensitive information to an unauthorized actor. A malicious authenticated local user coul CVE-2023-255377.8Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vul CVE-2023-255399.8Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could pot CVE-2023-25547.2External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0.CVE-2023-255407.1Dell PowerScale OneFS 9.4.0.x contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this CVE-2023-255427.8Dell Trusted Device Agent, versions prior to 5.3.0, contain(s) an improper installation permissions vulnerability. An unauthenticated local CVE-2023-255437.8Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service. A low privileged malicious user CVE-2023-255446.5Dell NetWorker versions 19.5 and earlier contain 'Apache Tomcat' version disclosure vulnerability. A NetWorker server user with remote acces CVE-2023-255456.7Improper buffer restrictions in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation CVE-2023-255462.5Out-of-bounds read in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via loc CVE-2023-255478.8A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker CVE-2023-255486.5A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being pr