Product:
SupportAssist OS Recovery
Summary
Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges. This could allow unauthorized users to gain higher access levels within the system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-46685 |
Exploitation
To exploit this vulnerability, an attacker with local access can create temporary files with insecure permissions. By manipulating these files, the attacker can elevate their privileges and gain unauthorized access to sensitive system resources. This requires a high level of complexity and user interaction, making it a targeted attack scenario.
Affected Products
- SupportAssist OS Recovery: Versions prior to 5.5.15.1 are affected by the vulnerability, allowing for potential privilege escalation.
Mitigation
To mitigate this vulnerability, users should update their Dell SupportAssist OS Recovery to version 5.5.15.1 or later. This update addresses the insecure permissions issue, reducing the risk of privilege escalation by ensuring that temporary files are created with secure permissions.