CVE-2025-46684: Dell SupportAssist Insecure File Vulnerability

CVE-2025-46684 Overview

CVE-2025-46684 is a Creation of Temporary File With Insecure Permissions vulnerability (CWE-378) affecting Dell SupportAssist OS Recovery versions prior to 5.5.15.1. This vulnerability allows a low-privileged attacker with local access to potentially exploit insecure file permissions on temporary files, leading to information tampering.

Critical Impact

Local attackers with low privileges can tamper with sensitive information through insecurely permissioned temporary files, potentially compromising system integrity and availability.

Affected Products

• Dell SupportAssist OS Recovery versions prior to 5.5.15.1

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-46684 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-46684

Vulnerability Analysis

This vulnerability stems from improper handling of temporary file permissions in Dell SupportAssist OS Recovery. When the application creates temporary files during its recovery operations, it fails to apply restrictive permissions, leaving these files accessible to unauthorized local users. The vulnerability requires local access and user interaction for successful exploitation, but once exploited, can result in high impact to both integrity and availability of the affected system.

The attack is categorized under CWE-378 (Creation of Temporary File With Insecure Permissions), which occurs when an application creates a temporary file with permissions that allow other users to read or modify the file's contents. In the context of Dell SupportAssist OS Recovery, this could allow an attacker to manipulate recovery-related data.

Root Cause

The root cause lies in the application's failure to set appropriate restrictive permissions when creating temporary files during OS recovery operations. Instead of creating temporary files with permissions restricted to the application or the executing user, the files are created with overly permissive access rights, enabling other local users to read and modify their contents.

Attack Vector

The attack requires local access to the system and a low-privileged user account. An attacker must identify and access the insecurely permissioned temporary files created by Dell SupportAssist OS Recovery. The attack scenario typically involves:

1. A low-privileged user monitors for temporary file creation during SupportAssist OS Recovery operations
2. The attacker accesses the temporary files due to their insecure permissions
3. The attacker modifies the contents of these files to tamper with recovery data
4. When the legitimate recovery process reads these tampered files, the modified data is processed, potentially leading to integrity and availability impacts

This vulnerability requires user interaction for exploitation, suggesting the attack timing may need to coincide with specific user or system activities.

Detection Methods for CVE-2025-46684

Indicators of Compromise

• Unexpected modifications to temporary files in system temp directories associated with Dell SupportAssist OS Recovery
• Anomalous file access patterns to SupportAssist-related temporary files by non-privileged processes
• File integrity monitoring alerts on temporary directories used by Dell recovery utilities

Detection Strategies

• Implement file integrity monitoring (FIM) on directories where Dell SupportAssist OS Recovery creates temporary files
• Monitor for suspicious process access to temporary files with overly permissive ACLs
• Enable advanced auditing on Windows systems to track file permission changes and access events
• Deploy endpoint detection and response (EDR) solutions to identify unusual local file manipulation patterns

Monitoring Recommendations

• Configure SentinelOne agents to monitor file operations in common temporary directories (%TEMP%, %TMP%, system temp folders)
• Set up alerts for low-privileged accounts accessing or modifying files created by Dell SupportAssist processes
• Review Windows Security Event logs for Event ID 4663 (object access) related to SupportAssist temporary files

How to Mitigate CVE-2025-46684

Immediate Actions Required

• Update Dell SupportAssist OS Recovery to version 5.5.15.1 or later immediately
• Audit systems for signs of exploitation, particularly unauthorized modifications to recovery-related temporary files
• Restrict local access to systems running vulnerable versions until patching is complete
• Review and harden file system permissions on directories used by Dell SupportAssist

Patch Information

Dell has released a security update addressing this vulnerability. Systems running Dell SupportAssist OS Recovery should be updated to version 5.5.15.1 or later. For complete patch details and download information, refer to the Dell Security Advisory DSA-2025-456.

Workarounds

• Restrict local system access to only trusted users until the patch can be applied
• Implement strict access controls on temporary directories used by Dell SupportAssist OS Recovery
• Use application whitelisting to prevent unauthorized processes from accessing SupportAssist temporary files
• Monitor and audit temporary file creation activities on systems where immediate patching is not feasible

If immediate patching is not possible, organizations should consider temporarily disabling Dell SupportAssist OS Recovery functionality until the update can be applied, weighing this against operational recovery requirements.