Dell SupportAssist CVE-2025-43991

Requires that the attacker already possess a local, low-privileged account on the affected Dell system (AV:L, PR:L) running SupportAssist for Home PCs ≤4.8.2 or SupportAssist for Business PCs ≤4.5.3; the attacker must be able to create a filesystem symbolic link at a location where the higher-privileged SupportAssist component performs a file operation, so that the link is followed (CWE-61) and the target file is deleted. Limiting factors: no remote network vector, no capability without an existing local foothold, and impact is confined to file deletion on that single host (S:U, C:N) with no direct code execution or data disclosure.

This is a genuinely moderate-severity, low-urgency issue - not a top-tier priority despite the 7.1 CVSS. All signals align consistently toward low real-world risk: the CVSS vector is AV:L/AC:L/PR:L (local access plus an existing low-privileged foothold required), EPSS is only 0.13% (2nd percentile), there is no CISA KEV listing, and no public exploit code was identified. The impact is bounded: C:N (no confidentiality loss) with I:H/A:H reflecting arbitrary file deletion, which can corrupt or deny service on the local host but does not grant code execution or data theft directly. The exploitation status is 'no public exploit identified at time of analysis.' No signals conflict - every source (CVSS, EPSS, absence of KEV/POC) points the same direction. The one caveat is sequencing: because exploitation presupposes an attacker already has local low-privileged access, the practical value is as a secondary primitive (e.g., deleting a protective file to enable a privilege-escalation chain) rather than a standalone initial-access flaw. Treat as a patch-in-normal-cycle item, not an emergency.

A local attacker who already holds an unprivileged account on a Dell PC plants a symbolic link where the SupportAssist service (running with higher privilege) performs a file operation, so that when the service follows the link it deletes a file the attacker could not otherwise remove. This could be abused to destroy a security control or system file and set up a further privilege-escalation or denial-of-service chain. No public proof-of-concept exploit is known at time of analysis.