Encryption CVE-2025-36564

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates moderate-to-high real-world risk: Local attack vector limits exposure to systems where the attacker already has user-level access, but Attack Complexity is Low (standard techniques work reliably), and Privilege Requirement is Low (unprivileged user sufficient). The lack of user interaction (UI:N) and system-scoped impact (C:H/I:H/A:H) mean reliable, silent privilege escalation is possible. Without confirmed KEV status or public POC availability, this remains a potential zero-day or low-visibility vulnerability post-disclosure. For enterprise security teams managing Dell Encryption solutions, this represents HIGH priority due to: (1) admin utility compromise could lead to wholesale encryption policy tampering, (2) local-to-system privilege escalation enables lateral movement and persistence, and (3) Dell Encryption Admin Utilities are typically deployed in regulated/security-sensitive environments. SSVC assessment: Exploitation status = Unspecified (post-patch, likely to be actively exploited); Automatable = Yes (symbolic link exploitation is standard); Technical Impact = Total (privilege escalation to SYSTEM or ADMIN level). Recommend prioritization for patching within 30 days.

An unprivileged local user on a Windows system running Dell Encryption Admin Utilities versions < 11.10.2 identifies that the admin utility reads encryption policies from a user-accessible temporary directory during initialization. The attacker creates a symbolic link at the expected policy file path pointing to a malicious script or DLL they control. When a privileged service or scheduled task runs the admin utility (or when the user logs in and the utility auto-loads), it follows the symlink and loads the attacker's payload with SYSTEM or Administrator privileges. The attacker gains code execution with high privileges, allowing them to disable encryption, exfiltrate encryption keys, modify encryption policies across the organization, or establish persistence. Attack complexity is low because this requires only basic file system operations (mklink command on Windows) and knowledge of common temp directories. No user interaction is required if the utility runs on a schedule or as a service, making this a reliable privilege escalation vector in shared or multi-user system environments.