VulnerabilityPublished 14 Aug 2025

CVE-2025-36613: Dell SupportAssist for Home PCs · Incorrect Privilege Assignment

Affects Dell SupportAssist for Home PCsSource CVE Database V5

Not known to be exploited · CVSS 2.8 Low.

Data as of 26 Oct 2026, 14:05 UTC

CVSS 3.1 base score

2.8Low

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Dell SupportAssist for Home PCs	Affected <=4.6.3	Fixed in–

AI-suggested

To mitigate this vulnerability effectively, European organizations should: 1) Immediately verify the version of Dell SupportAssist installed on all endpoints and prioritize upgrading to versions beyond 4.6.3 for Home PCs and 4.5.3 for Business PCs once patches are released. 2) Until patches are available, restrict local access to endpoints by enforcing strict physical security controls and limiting user accounts with local login rights. 3) Implement application whitelisting and endpoint protection solutions that can monitor or block unauthorized attempts to exploit privilege assignments within SupportAssist. 4) Use least privilege principles for user accounts, ensuring users do not have unnecessary local privileges that could be leveraged. 5) Monitor system logs and SupportAssist activity for unusual behavior indicative of privilege escalation attempts. 6) Educate users about the risks of local access attacks and enforce policies to prevent unauthorized physical or remote access. 7) Coordinate with Dell support channels to receive timely updates and patches and test them in controlled environments before wide deployment. These steps go beyond generic advice by focusing on controlling local access vectors and monitoring the specific application involved.

Description

SupportAssist for Home PCs versions 4.6.3 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

Impact

For European organizations, the impact of this vulnerability is generally limited due to the low severity and local access requirement. However, Dell SupportAssist is widely used across both consumer and business segments in Europe, especially in enterprises relying on Dell hardware for endpoint management. If an attacker gains local access—such as through physical access, social engineering, or via other compromised accounts—they could leverage this vulnerability to escalate privileges or bypass restrictions within the SupportAssist application. This could lead to unauthorized changes in system configurations or access to diagnostic data, potentially aiding further attacks or persistence. While the vulnerability does not directly compromise confidentiality or availability, the integrity impact could facilitate lateral movement or privilege escalation chains in targeted attacks. Organizations with less stringent endpoint physical security or those with many remote or mobile users might face higher risks. Additionally, environments with shared or multi-user systems could be more vulnerable to exploitation. Overall, the threat is moderate but should not be ignored, especially in sensitive or regulated sectors where even low-level privilege escalations can have compliance or operational consequences.

CWE-266Incorrect Privilege Assignment (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Operation · Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment.
OWASP Cheat Sheets
Docker Security (opens in a new tab)
Third Party Javascript Management (opens in a new tab)
Virtual Patching (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V1.4.4 (opens in a new tab)
V1.4.5 (opens in a new tab)
V1.10.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

dell.com/support/kbdoc/en-us/000356690/dsa-2025-296-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2025, 15:20 UTC

WeaknessesCWE-266

Technical details

References

Community reviews

Related threats