CVE-2021-36297 is a vulnerability in Dell Supportassist For Home Pcs
Published on September 28, 2021
SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll planting/hijacking, only by a separate administrative action that is not a default part of the SOSInstallerTool.exe installation for executing arbitrary dll's,
Vulnerability Analysis
CVE-2021-36297 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is an Untrusted Path Vulnerability?
The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.
CVE-2021-36297 has been classified to as an Untrusted Path vulnerability or weakness.
Products Associated with CVE-2021-36297
Want to know whenever a new CVE is published for Dell Supportassist For Home Pcs? stack.watch will email you.
Affected Versions
Dell SupportAssist Client Consumer Version 3.8, 3.9 is affected by CVE-2021-36297Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.