Dell warns of remote code execution vulnerability

Dell has issued a security update for its SupportAssist client, pre-installed on 'most of all new Dell devices running [the] Windows operating system', after the discovery of two serious security vulnerabilities - including one allowing for remote code execution.

Designed to monitor the health of systems, including - ironically - the status of security updates, the SupportAssist Client aims to make troubleshooting and remote support of Dell systems as easy as possible. Unfortunately, it also turns out to make remote attacks against Dell systems as easy as possible thanks to a pair of serious security vulnerabilities which allow remote attackers to execute arbitrary code on affected systems.

In a security advisory first spotted by security site Bleeping Computer, Dell confirms that all versions of the SupportAssist Client software - which comes pre-loaded on the majority of the company's Windows devices - prior to the updated 3.2.0.90 are affected by a pair of vulnerabilities. The first allows for cross-site request forgery attacks; the second allows for remote code execution. Both are rated as high severity, and affect only the company's Windows-based products - not the handful of systems it sells running alternative operating systems.

Dell's recommendation is that all users should update to the latest SupportAssist Client as soon as possible; an alternative fix, of course, is to uninstall the software altogether. A fixed version of the software is available to download from a link at the bottom of the support notice.