CVE-2025-43991

SupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain an UNIX Symbolic Link (Symlink) following vulnerability. A low privileged attacker with local access to the system could potentially exploit this vulnerability to delete arbitrary files only in that affected system.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000378367/dsa-2025-362-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:supportassist_for_business_pcs::::::::
	cpe:2.3:a:dell:supportassist_for_home_pcs::::::::

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) SupportAssist para Home PCs versiones 4.8.2 y anteriores y SupportAssist para Business PCs versiones 4.5.3 y anteriores, contienen una vulnerabilidad de seguimiento de enlace simbólico (Symlink) de UNIX. Un atacante con privilegios bajos con acceso local al sistema podría potencialmente explotar esta vulnerabilidad para eliminar archivos arbitrarios solo en ese sistema afectado.

Information

Published : 2025-10-13 15:16

Updated : 2026-10-18 21:10

NVD link : CVE-2025-43991

Mitre link : CVE-2025-43991

CVE.ORG link : CVE-2025-43991

JSON object : View

Products Affected

dell

supportassist_for_business_pcs
supportassist_for_home_pcs

CWE

CWE-61

UNIX Symbolic Link (Symlink) Following

{"id": "CVE-2025-43991", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43991", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T14:34:16.209824Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security_alert@emc.com", "affectedData": [{"vendor": "Dell", "product": "SupportAssist for Home PCs", "versions": [{"status": "affected", "version": "N/A", "lessThan": "4.10.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "SupportAssist for Business PCs", "versions": [{"status": "affected", "version": "N/A", "lessThan": "4.9.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-13T15:16:04.267", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000378367/dsa-2025-362-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-61"}]}], "descriptions": [{"lang": "en", "value": "SupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain an UNIX Symbolic Link (Symlink) following vulnerability. A low privileged attacker with local access to the system could potentially exploit this vulnerability to delete arbitrary files only in that affected system."}, {"lang": "es", "value": "SupportAssist para Home PCs versiones 4.8.2 y anteriores y SupportAssist para Business PCs versiones 4.5.3 y anteriores, contienen una vulnerabilidad de seguimiento de enlace simb\u00f3lico (Symlink) de UNIX. Un atacante con privilegios bajos con acceso local al sistema podr\u00eda potencialmente explotar esta vulnerabilidad para eliminar archivos arbitrarios solo en ese sistema afectado."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:supportassist_for_business_pcs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9831B6C9-0619-4B5A-9985-9DA11E36E9C8", "versionEndExcluding": "4.5.3.25254"}, {"criteria": "cpe:2.3:a:dell:supportassist_for_home_pcs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BD98898-301B-460B-9A13-3F6C904CF98C", "versionEndExcluding": "4.8.2.29006"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}