CVE-2025-36611: Dell Encryption Privilege Escalation Flaw

CVE-2025-36611 Overview

CVE-2025-36611 affects Dell Encryption and Dell Security Management Server versions prior to 11.11.0. The flaw is an Improper Link Resolution Before File Access weakness, commonly called a link following vulnerability [CWE-59]. A local authenticated user can abuse how the affected products resolve file system links to redirect privileged file operations to attacker-controlled paths. Successful exploitation leads to privilege escalation on the host running the vulnerable Dell software. Dell published advisory DSA-2025-292 and shipped fixed builds in version 11.11.0.

Critical Impact
A low-privileged local user can escalate to elevated privileges by exploiting link following in Dell Encryption or Dell Security Management Server, compromising confidentiality, integrity, and availability of the host.

Affected Products

Dell Encryption versions prior to 11.11.0
Dell Security Management Server versions prior to 11.11.0
Endpoints and management servers running Dell data protection agents below the fixed build

Discovery Timeline

2025-07-30 - CVE-2025-36611 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36611

Vulnerability Analysis

The vulnerability sits in the file access logic of Dell Encryption and Dell Security Management Server components. The affected code paths follow symbolic links, junctions, or hard links without validating that the resolved target belongs to a trusted location. Because privileged Dell services perform file operations on paths that a local user can influence, an attacker can redirect writes, deletes, or attribute changes to sensitive system files. The attack requires local access and low privileges, and it does not require user interaction. Once exploited, the attacker inherits SYSTEM-level control over the affected host.

Root Cause

The root cause is improper link resolution before file access [CWE-59]. Dell Encryption and Dell Security Management Server open or manipulate files under user-writable directories without checking whether path components have been replaced with links. When a privileged Dell process opens the target, the operating system transparently follows the link and applies the operation to the attacker-chosen destination.

Attack Vector

Exploitation is local. A user with a standard account plants a symbolic link, junction, or hard link inside a directory that the privileged Dell service reads or writes. When the service performs its next scheduled or triggered file operation, the operation is redirected to a file the attacker could not otherwise modify. Attackers commonly target service binaries, DLL search paths, or configuration files to gain code execution as SYSTEM. Public exploit code for CVE-2025-36611 is not currently available, and CISA has not listed it in the Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. See the Dell Security Advisory DSA-2025-292 for vendor-provided technical detail.

Detection Methods for CVE-2025-36611

Indicators of Compromise

Creation of symbolic links, NTFS junctions, or hard links inside directories used by Dell Encryption or Dell Security Management Server processes
Unexpected modification of files owned by SYSTEM shortly after activity from a standard user account
New or altered executables and DLLs in Dell installation directories that do not match vendor-signed binaries

Detection Strategies

Hunt for CreateSymbolicLink, mklink, or CreateHardLink API activity originating from non-administrative user contexts on hosts running Dell Encryption agents
Correlate file writes performed by Dell service processes with the presence of reparse points in the target path
Baseline file integrity for the Dell Encryption and Security Management Server installation directories and alert on drift

Monitoring Recommendations

Enable Windows Sysmon Event IDs 11 (FileCreate) and 15 (FileCreateStreamHash) on hosts with Dell Encryption installed and forward to a central log platform
Monitor privileged Dell service accounts for file operations that resolve outside expected working directories
Track installed Dell Encryption and Security Management Server versions across the fleet and alert on builds below 11.11.0

How to Mitigate CVE-2025-36611

Immediate Actions Required

Upgrade Dell Encryption and Dell Security Management Server to version 11.11.0 or later on every affected endpoint and server
Inventory all systems running Dell data protection agents and prioritize patching hosts with interactive local users
Restrict local logon rights on servers hosting Dell Security Management Server to reduce the population of potential attackers

Patch Information

Dell released fixed builds in version 11.11.0 for both Dell Encryption and Dell Security Management Server. Patch details and download instructions are documented in the Dell Security Advisory DSA-2025-292. Apply the vendor-supplied installer on both client and server components to ensure the link resolution logic is corrected across the deployment.

Workarounds

Limit interactive and remote desktop access on affected hosts to trusted administrators until patching completes
Remove unnecessary write permissions on directories accessed by privileged Dell services to prevent link planting
Where supported, disable the creation of symbolic links for non-administrative users by revoking the SeCreateSymbolicLinkPrivilege right through Group Policy

bash

# Group Policy path to restrict symbolic link creation on Windows hosts
# Computer Configuration > Windows Settings > Security Settings >
#   Local Policies > User Rights Assignment > "Create symbolic links"
# Remove standard user groups and retain only Administrators.