CVE-2025-36612: Dell SupportAssist Privilege Escalation

CVE-2025-36612 Overview

CVE-2025-36612 is an Incorrect Privilege Assignment vulnerability [CWE-266] affecting Dell SupportAssist for Business PCs. The flaw exists in versions 4.5.3 and prior. A low-privileged local attacker can exploit the vulnerability to elevate privileges on the affected system. Dell disclosed the issue in security advisory DSA-2025-296, which also addresses related flaws in SupportAssist for Home PCs.

Critical Impact
Successful exploitation grants an authenticated local attacker elevated privileges, exposing endpoint confidentiality, integrity, and availability to full compromise.

Affected Products

Dell SupportAssist for Business PCs version 4.5.3
Dell SupportAssist for Business PCs versions prior to 4.5.3
Windows endpoints running SupportAssist for enterprise device support

Discovery Timeline

2025-08-14 - CVE-2025-36612 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36612

Vulnerability Analysis

Dell SupportAssist for Business PCs runs privileged service components used to perform diagnostics, driver updates, and remote support tasks. The product assigns privileges to certain operations or resources in a manner that does not correctly separate low-privileged user actions from high-privileged service actions. An attacker who already holds standard user access on the host can leverage this incorrect privilege assignment to perform operations reserved for SYSTEM or administrative contexts.

The issue is classified under CWE-266: Incorrect Privilege Assignment. Exploitation requires local access and low authentication, but no user interaction. Successful exploitation yields high impact against confidentiality, integrity, and availability of the host.

Root Cause

The root cause is improper enforcement of privilege boundaries within SupportAssist components. The application grants access, permissions, or execution rights to entities that should operate at a lower privilege level. This design flaw allows a low-privileged process or user to inherit or invoke privileged functionality without proper authorization checks.

Attack Vector

The attack vector is local. An attacker must first obtain code execution or interactive login as a standard user on a Windows endpoint where SupportAssist for Business PCs 4.5.3 or earlier is installed. From that context, the attacker interacts with the vulnerable SupportAssist components to escalate to administrator or SYSTEM privileges. Refer to the Dell Security Advisory DSA-2025-296 for vendor-provided technical context. No public proof-of-concept or exploit is currently available.

Detection Methods for CVE-2025-36612

Indicators of Compromise

Unexpected child processes spawned by SupportAssist service binaries running as SYSTEM
Standard user accounts gaining membership in the local Administrators group without change-management approval
Modification of files or registry keys under the SupportAssist installation path by non-privileged users

Detection Strategies

Inventory endpoints for SupportAssist for Business PCs versions 4.5.3 and earlier and prioritize them for patching
Monitor for privilege escalation patterns where a low-privileged process interacts with SupportAssist components before spawning elevated processes
Correlate Windows Security Event ID 4672 (special privileges assigned) with recent SupportAssist activity on the same host

Monitoring Recommendations

Enable process creation auditing with command-line logging on all endpoints running Dell management software
Alert on service configuration changes or DLL loads targeting the SupportAssist installation directory
Track sudden elevation of local user accounts and cross-reference with SupportAssist process lineage

How to Mitigate CVE-2025-36612

Immediate Actions Required

Upgrade Dell SupportAssist for Business PCs to a version later than 4.5.3 as directed by DSA-2025-296
Identify all endpoints running vulnerable versions across managed fleets and enforce patch deployment
Restrict local logon rights on business PCs to limit which users can attempt local exploitation

Patch Information

Dell has released fixed versions in Dell Security Advisory DSA-2025-296. Administrators should apply the update through Dell Command Update, SupportAssist auto-update, or manual installation from the Dell support portal. Verify installed version after patching to confirm remediation.

Workarounds

If patching is delayed, remove or disable SupportAssist for Business PCs on high-risk endpoints until the update is applied
Restrict standard user access to the SupportAssist installation directory and service configuration where feasible
Apply application allowlisting to block untrusted binaries from interacting with SupportAssist components

bash

# Query installed SupportAssist version on a Windows endpoint
Get-CimInstance -ClassName Win32_Product | Where-Object { $_.Name -like "*SupportAssist*" } | Select-Object Name, Version