Product:
SupportAssist
Summary
SupportAssist for Home PCs and SupportAssist for Business PCs contain a UNIX Symbolic Link vulnerability. A low privileged attacker with local access could exploit this vulnerability to delete arbitrary files on the affected system. This poses a significant risk to the integrity of the system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.3 | CVE-2025-43991 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system. By leveraging the UNIX Symbolic Link vulnerability, the attacker can manipulate file paths to delete files that should not be accessible. This requires a certain level of privilege, but once achieved, the attacker can cause significant damage to the system’s file structure.
Affected Products
- SupportAssist for Home PCs versions 4.8.2 and prior
- SupportAssist for Business PCs versions 4.5.3 and prior
Mitigation
To mitigate this vulnerability, users should update their SupportAssist software to the latest versions. Regularly applying security updates and patches can help protect against potential exploitation. Additionally, restricting local access to sensitive systems can reduce the risk of unauthorized exploitation.