CVE-2025-38747: Dell SupportAssist OS Recovery Escalation

CVE-2025-38747 Overview

CVE-2025-38747 affects Dell SupportAssist OS Recovery versions prior to 5.5.14.0. The vulnerability results from creation of temporary files with insecure permissions [CWE-378]. A local authenticated attacker can exploit this weakness to achieve elevation of privileges on the affected system.

Dell published the issue on August 6, 2025, through security advisory DSA-2025-315. The flaw requires local access and low privileges, but no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the host.

Critical Impact
A local authenticated user can escalate to higher privileges by leveraging predictable or world-writable temporary files created by Dell SupportAssist OS Recovery.

Affected Products

Dell SupportAssist OS Recovery versions prior to 5.5.14.0
Windows endpoints with Dell SupportAssist OS Recovery preinstalled
Dell consumer and commercial systems shipping with SupportAssist components

Discovery Timeline

2025-08-06 - CVE-2025-38747 published to NVD and Dell releases advisory DSA-2025-315
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38747

Vulnerability Analysis

Dell SupportAssist OS Recovery creates temporary files during recovery and diagnostic operations. Before version 5.5.14.0, these files are created with insecure permissions. The permissions allow lower-privileged local users to read, modify, or replace the files while a higher-privileged process consumes them.

The vulnerability class, tracked under CWE-378: Creation of Temporary File With Insecure Permissions, commonly enables privilege escalation. An attacker who can predict or observe temporary file paths can substitute malicious content or symbolic links before the privileged process acts on them.

Exploitation requires local authentication but does not require user interaction. The result is code execution or file operations in the context of the privileged SupportAssist process.

Root Cause

The root cause is improper access control on files created in shared temporary directories. Dell SupportAssist OS Recovery does not restrict discretionary access control lists (DACLs) on these files to the creating user or SYSTEM account. Any authenticated local user on the endpoint can interact with the files during the exploit window.

Attack Vector

The attack vector is local. An authenticated user places crafted content at the predictable temporary file location or replaces existing artifacts using a race condition or symbolic link. When SupportAssist OS Recovery reads, writes, or executes the file with elevated privileges, the attacker's content is processed. This yields elevation of privileges up to the service account used by SupportAssist.

No public proof-of-concept exploit is currently documented, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Dell Security Advisory DSA-2025-315 for vendor-supplied technical details.

Detection Methods for CVE-2025-38747

Indicators of Compromise

Unexpected files or symbolic links in temporary directories used by Dell SupportAssist OS Recovery processes.
Modifications to SupportAssist temporary artifacts by user accounts other than SYSTEM or the installing administrator.
Child processes spawned by SupportAssist OS Recovery components running with elevated tokens but originating from user-controlled file paths.

Detection Strategies

Monitor file creation and DACL changes on paths used by SupportAssistOSRecovery executables and helper processes.
Alert on non-administrative users writing to temporary directories immediately before a privileged SupportAssist process reads from the same location.
Correlate process ancestry to identify privilege transitions where SupportAssist components execute code originating from user-writable files.

Monitoring Recommendations

Enable Windows object access auditing on Dell SupportAssist temporary directories to capture file creation, modification, and permission changes.
Track version inventory of Dell SupportAssist OS Recovery across the fleet and flag hosts running versions prior to 5.5.14.0.
Review endpoint telemetry for symbolic link creation by standard users targeting SupportAssist file paths.

How to Mitigate CVE-2025-38747

Immediate Actions Required

Upgrade Dell SupportAssist OS Recovery to version 5.5.14.0 or later on all affected endpoints.
Inventory Dell endpoints to confirm SupportAssist OS Recovery version and remediation status.
Restrict local logon rights on systems that cannot be patched immediately to reduce the attacker population.

Patch Information

Dell released a fixed build in Dell SupportAssist OS Recovery version 5.5.14.0. Apply the update referenced in Dell Security Advisory DSA-2025-315. Verify installation by checking the installed version through Programs and Features or the SupportAssist application interface.

Workarounds

If patching is delayed, disable or uninstall Dell SupportAssist OS Recovery on systems that do not require the recovery workflow.
Enforce least privilege on shared workstations to limit the number of local authenticated users capable of exploiting the flaw.
Apply endpoint application control policies that block execution of untrusted binaries from user-writable temporary paths.

bash

# Verify installed Dell SupportAssist OS Recovery version on Windows
Get-WmiObject -Class Win32_Product | \
  Where-Object { $_.Name -like "*SupportAssist OS Recovery*" } | \
  Select-Object Name, Version

# Uninstall if version is prior to 5.5.14.0 and patch cannot be applied immediately
# (replace {ProductCode} with the value returned by the query above)
msiexec /x {ProductCode} /qn