« Volver al listado

CVE-2021-21518

Estado: ModificadaAlta (7.8)—

Dell SupportAssist Client for Consumer PCs versions 3.7.x, 3.6.x, 3.4.x, 3.3.x, Dell SupportAssist Client for Business PCs versions 2.0.x, 2.1.x, 2.2.x, and Dell SupportAssist Client ProManage 1.x contain a DLL injection vulnerability in the Costura Fody plugin. A local user with low privileges could potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with SYSTEM privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Dell — Supportassist Client PromanageDell — Supportassist FOR Business PCSDell — Supportassist FOR Home PCS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-21518",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "Dell SupportAssist Client",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "SACH 3.8, SACB 2.3",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-03-12T20:15:11.420",
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000184012/dsa-2021-052-dell-supportassist-for-home-pcs-business-pcs-security-update-for-pc-doctor-plugin-vulnerability",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000184012/dsa-2021-052-dell-supportassist-for-home-pcs-business-pcs-security-update-for-pc-doctor-plugin-vulnerability",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell SupportAssist Client for Consumer PCs versions 3.7.x, 3.6.x, 3.4.x, 3.3.x, Dell SupportAssist Client for Business PCs versions 2.0.x, 2.1.x, 2.2.x, and Dell SupportAssist Client ProManage 1.x contain a DLL injection vulnerability in the Costura Fody plugin. A local user with low privileges could potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with SYSTEM privileges."
    },
    {
      "lang": "es",
      "value": "Dell SupportAssist Client for Consumer PCs versiones 3.7.x, 3.6.x, 3.4.x, 3.3.x, Dell SupportAssist Client for Business PCs versiones 2.0.x, 2.1.x, 2.2.x y Dell SupportAssist Client ProManage versión 1.x, contienen una vulnerabilidad de inyección DLL en el plugin Costura Fody. Un usuario local poco privilegiado podría explotar esta vulnerabilidad, conllevando a una ejecución de un ejecutable arbitrario en el sistema operativo con privilegios SYSTEM"
    }
  ],
  "lastModified": "2026-06-17T03:35:42.740",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:supportassist_client_promanage:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD3C2335-489E-4886-A576-4BBD3AC98870"
            },
            {
              "criteria": "cpe:2.3:a:dell:supportassist_for_business_pcs:2.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD01BE4E-FF64-43DC-B2B7-F2F6BDA8F269"
            },
            {
              "criteria": "cpe:2.3:a:dell:supportassist_for_business_pcs:2.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97A49CD3-DC0D-4404-9FBD-8BD6801E1B27"
            },
            {
              "criteria": "cpe:2.3:a:dell:supportassist_for_business_pcs:2.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5C12BF6-07A7-401E-BF43-27EEEDFA1598"
            },
            {
              "criteria": "cpe:2.3:a:dell:supportassist_for_home_pcs:3.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7749B9C9-72A5-47C7-B8F5-5AB11CD2B130"
            },
            {
              "criteria": "cpe:2.3:a:dell:supportassist_for_home_pcs:3.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39D7A1D4-D5A2-49AA-9186-0F3D345D6585"
            },
            {
              "criteria": "cpe:2.3:a:dell:supportassist_for_home_pcs:3.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1083A3BD-E9B8-40C8-83B1-218CB6D76A0A"
            },
            {
              "criteria": "cpe:2.3:a:dell:supportassist_for_home_pcs:3.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9CFC107-2F62-4FFA-BE21-582981E8D503"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}