CVE-2021-36297
High
Description
SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll planting/hijacking, only by a separate administrative action that is not a default part of the SOSInstallerTool.exe installation for executing arbitrary dll's,
SeverityHigh
CVSS7.8
Exploit probability—
ProductDell Supportassist For Home Pcs
PublishedSep 28, 2021
First seenSep 28, 2021
Weakness typeCWE-426CWE-426
How to fix
Update
- dell supportassist_for_home_pcs3.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell supportassist_for_home_pcs | v < 3.9.0 | 3.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.