CVE-2023-39249

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables IT/System Administrators to perform driver scans and Dell-recommended driver installations without requiring them to log out of the local non-admin user session. However, the granted privilege is limited solely to the SupportAssist User Interface and automatically expires after 15 minutes.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-280

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-392505.5Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager CVE-2023-392516.7Dell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high privileges could potentially exploit this vu CVE-2023-392525.9Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potential CVE-2023-392537.8Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated CVE-2023-392547.3Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user with local access to CVE-2023-392567.8Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious standard user could p CVE-2023-392577.8Dell Rugged Control Center, version prior to 4.7, contains an Improper Access Control vulnerability. A local malicious standard user could p CVE-2023-392597.8Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated CVE-2023-392617.8In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions CVE-2023-392644.3By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vul CVE-2023-392656.5Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like CVE-2023-392666.1A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site