Vulnerability · Published Jul 22, 2021 · Assigned by dell
CVE-2020-5316
High 7.8
In plain English
A high-severity uncontrolled search path in Dell SupportAssist Client from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3, 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, 3.2.1, 3.2.2, 3.3, 3.3.1, 3.3.2, 3.3.3, 3.4 contain an uncontrolled search path vulnerability. A locally authenticated low privileged user could exploit this vulnerability to cause the loading of arbitrary DLLs by the SupportAssist binaries, resulting in the privileged execution of arbitrary code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dell | Dell SupportAssist Client | unspecified – before Dell SupportAssist for Business PCs version 2.1.4 and Dell SupportAssist for Home PCs version 3.4.1 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.dell.com/support/article/SLN320101 x_refsource_MISC