CVE-2025-36613: Dell SupportAssist Privilege Escalation

CVE-2025-36613 Overview

CVE-2025-36613 is an Incorrect Privilege Assignment vulnerability [CWE-266] affecting Dell SupportAssist for Home PCs and Dell SupportAssist for Business PCs. The flaw allows a low-privileged local attacker to escalate privileges on affected systems. Dell SupportAssist for Home PCs versions 4.6.3 and prior, and Dell SupportAssist for Business PCs versions 4.5.3 and prior are impacted. Successful exploitation leads to unauthorized access with elevated privileges on the target host. Dell published advisory DSA-2025-296 addressing the issue.

Critical Impact
A local, low-privileged user can leverage incorrect privilege assignment in Dell SupportAssist to gain unauthorized access with impact to confidentiality, integrity, and availability.

Affected Products

Dell SupportAssist for Home PCs versions 4.6.3 and prior
Dell SupportAssist for Business PCs versions 4.5.3 and prior
Windows endpoints with Dell SupportAssist installed

Discovery Timeline

2025-08-14 - CVE-2025-36613 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36613

Vulnerability Analysis

Dell SupportAssist runs with elevated privileges to perform diagnostics, driver updates, and system maintenance on Dell endpoints. The vulnerability stems from incorrect privilege assignment within the SupportAssist application. A local user without administrative rights can interact with privileged components in a manner that grants unintended access to protected resources or operations. Because SupportAssist is preinstalled on many Dell consumer and enterprise PCs, the exposed attack surface is broad. The attack requires local access but does not require user interaction, making it a viable post-compromise privilege escalation path for adversaries who obtain initial footholds through phishing, drive-by downloads, or unrelated exploits.

Root Cause

The root cause is classified under CWE-266: Incorrect Privilege Assignment. SupportAssist components assign privileges to actors or resources incorrectly, allowing a low-privileged process or user to acquire capabilities that should be restricted to administrators. Dell has not published the specific technical mechanism, but the CWE class typically involves misconfigured access tokens, service DACLs, or child-process privilege inheritance.

Attack Vector

Exploitation requires local access to a system running a vulnerable SupportAssist version. An attacker with standard user credentials interacts with the SupportAssist service or its helper components to trigger the privilege assignment flaw. No user interaction from another account is required. The result is elevated code execution or access to files, registry keys, or system operations that should be gated behind administrative privilege. Refer to the Dell Security Update Advisory (DSA-2025-296) for vendor-supplied technical detail.

Detection Methods for CVE-2025-36613

Indicators of Compromise

Unexpected child processes spawned by SupportAssist binaries such as SupportAssistAgent.exe or related services running under SYSTEM.
Non-administrative users invoking SupportAssist executables or writing to SupportAssist installation directories under C:\Program Files\Dell\SupportAssist.
New scheduled tasks, services, or persistence mechanisms created shortly after SupportAssist process activity.

Detection Strategies

Monitor process creation events (Windows Event ID 4688, Sysmon Event ID 1) for SupportAssist processes spawning shells, cmd.exe, powershell.exe, or unsigned binaries.
Alert on privilege changes and token manipulation events tied to SupportAssist components on hosts running vulnerable versions.
Baseline expected SupportAssist behavior and flag deviations, particularly file writes or registry changes originating from user-context processes into administrator-owned locations.

Monitoring Recommendations

Inventory endpoints and confirm SupportAssist version using registry keys under HKLM\SOFTWARE\Dell\SupportAssistAgent to identify unpatched systems.
Correlate local logon events with subsequent SupportAssist activity to identify anomalous invocation patterns.
Forward endpoint telemetry to a centralized data lake for retrospective hunting once new indicators emerge.

How to Mitigate CVE-2025-36613

Immediate Actions Required

Update Dell SupportAssist for Home PCs to a version later than 4.6.3 and Dell SupportAssist for Business PCs to a version later than 4.5.3 as instructed in DSA-2025-296.
Restrict local logon rights on sensitive endpoints to reduce the pool of accounts that can trigger the flaw.
Audit endpoints for SupportAssist installations that are outdated or no longer required and remove them where possible.

Patch Information

Dell released fixed versions of SupportAssist for Home PCs and SupportAssist for Business PCs. Apply the updates referenced in the Dell Security Update Advisory (DSA-2025-296). SupportAssist supports automatic updates; verify the update channel is enabled and the client has successfully upgraded.

Workarounds

Uninstall Dell SupportAssist on systems where the tool is not required for warranty or diagnostic workflows.
Disable the SupportAssist services on managed endpoints until the update is applied through group policy or endpoint management tooling.
Apply the principle of least privilege and remove unnecessary local accounts to limit exposure to local privilege escalation.

bash

# Verify installed SupportAssist version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Dell\SupportAssistAgent" | Select-Object Version

# Uninstall SupportAssist as a temporary workaround (requires admin)
Get-Package -Name "Dell SupportAssist*" | Uninstall-Package -Force