CVE-2019-3719 - Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability.

CVE-2019-3719

Summary

Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.

References

https://www.dell.com/support/article/us/en/19/sln316857/dsa-2019-051-dell-supportassist-client-multiple-vulnerabilities?lang=en

Vulnerable Configurations

cpe:2.3:a:dell:supportassist:-:*:*:*:*:*:*:*
cpe:2.3:a:dell:supportassist:-:*:*:*:*:*:*:*

CVSS

Base:	7.9 (as of 01-01-2022 - 20:16)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
ADJACENT_NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:A/AC:M/Au:N/C:C/I:C/A:C

refmap via4

misc

https://www.dell.com/support/article/us/en/19/sln316857/dsa-2019-051-dell-supportassist-client-multiple-vulnerabilities?lang=en

Last major update

01-01-2022 - 20:16

Published

18-04-2019 - 20:29

Last modified

01-01-2022 - 20:16