CVE-2022-34389 Security feature bypass in SupportAssist

What is CVE-2022-34389?

CVE-2022-34389 is a low-severity vulnerability in Dell SupportAssist , published on 10 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vulnerability and impersonate a legitimate dell customer to a dell support technician.

Weakness: CWE-307

Which versions are affected by CVE-2022-34389?

It affects 2 products.

Products include Dell Supportassist for Business Pcs, Dell Supportassist for Home Pcs.

How do I fix CVE-2022-34389?

No fix has been published for CVE-2022-34389 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-34389 being exploited?

There is no known exploitation of CVE-2022-34389 in the wild and no public exploit code.

Other vulnerabilities in Dell SupportAssist

• CVE-2022-29095 Cross-site scripting in SupportAssist Consumer High 8.3
• CVE-2023-44283 Privilege escalation in SupportAssist for Business PCs High 7.8
• CVE-2022-29092 Privilege escalation in SupportAssist Consumer High 7.8
• CVE-2020-5316 Other in Dell SupportAssist Client High 7.8
• CVE-2019-12280 Path traversal in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-662p-4xh8-66rf.