Improper privilege management in Dell SupportAssist for Business PCs
Priority LOW 34CWE-269Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.
Summary
Dell SupportAssist for Business PCs version 2.0 and Dell SupportAssist for Home PCs version 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, and 3.2.1 contain an Improper Privilege Management Vulnerability. A malicious local user can exploit this vulnerability by inheriting a system thread using a leaked thread handle to gain system privileges on the affected machine.
Why it matters now
EPSS 0.00259 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Dell SupportAssist for Business PCs | 2.0 | — | No fix listed | CNA |
| Dell | Dell SupportAssist for Home PCs | 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, and 3.2.1 | — | No fix listed | CNA |
- Dell SupportAssist for Business PCs VendorDell Affected 2.0 Fixed in — No fix listed CNA
- Dell SupportAssist for Home PCs VendorDell Affected 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, and 3.2.1 Fixed in — No fix listed CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:supportassist_for_home_pcs:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | Dell |
| cpe:2.3:a:dell:supportassist_for_home_pcs:2.2.1:*:*:*:*:*:*:* | 2.2.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:supportassist_for_home_pcs:2.2.2:*:*:*:*:*:*:* | 2.2.2 | Vulnerable | Dell |
| cpe:2.3:a:dell:supportassist_for_home_pcs:2.2.3:*:*:*:*:*:*:* | 2.2.3 | Vulnerable | Dell |
| cpe:2.3:a:dell:supportassist_for_home_pcs:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Dell |
| cpe:2.3:a:dell:supportassist_for_home_pcs:3.0.1:*:*:*:*:*:*:* | 3.0.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:supportassist_for_home_pcs:3.0.2:*:*:*:*:*:*:* | 3.0.2 | Vulnerable | Dell |
| cpe:2.3:a:dell:supportassist_for_home_pcs:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:supportassist_for_home_pcs:3.2:*:*:*:*:*:*:* | 3.2 | Vulnerable | Dell |
| cpe:2.3:a:dell:supportassist_for_home_pcs:3.2.1:*:*:*:*:*:*:* | 3.2.1 | Vulnerable | Dell |
- cpe:2.3:a:dell:supportassist_for_home_pcs:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Dell
- cpe:2.3:a:dell:supportassist_for_home_pcs:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Dell
- cpe:2.3:a:dell:supportassist_for_home_pcs:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Dell
- cpe:2.3:a:dell:supportassist_for_home_pcs:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Dell
- cpe:2.3:a:dell:supportassist_for_home_pcs:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Dell
- cpe:2.3:a:dell:supportassist_for_home_pcs:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Dell
- cpe:2.3:a:dell:supportassist_for_home_pcs:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Dell
- cpe:2.3:a:dell:supportassist_for_home_pcs:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Dell
- cpe:2.3:a:dell:supportassist_for_home_pcs:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Dell
- cpe:2.3:a:dell:supportassist_for_home_pcs:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Dell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3735
- 2026-10-03 Alias added: GHSA-mhgq-rp37-738w
References
More Dell Supportassist For Business Pcs vulnerabilities
- TI-2022-11646 Cross-site scripting in Dell SupportAssist Consumer CVSS 3.1CRITICAL 9.6
- TI-2024-35205 Link following in Dell SupportAssist for Home PCs CVSS 3.1HIGH 8.8
- TI-2019-09165 PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element. CVSS 3.0HIGH 7.8
- TI-2023-23805 Improper access control in Dell SupportAssist for Home PCs CVSS 3.1HIGH 7.8
- TI-2022-15283 Improper privilege management in Dell SupportAssist Client Consumer CVSS 3.1HIGH 7.8
- TI-2025-24916 SupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect… CVSS 3.1HIGH 7.8
Sources
- CVE-2019-3735 · CVE Program
- CVE-2019-3735 · NVD
- FIRST EPSS
- GHSA-mhgq-rp37-738w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences