Trusted Device Client
Monthly
Incorrectly assigned permissions on critical resources shipped with Dell Trusted Device Client (all versions prior to 8.1.359.0) let a low-privileged local user write to or modify files, directories, registry keys, or service configuration belonging to the agent, enabling tampering with trusted-device state and, per the vendor vector, disclosure of sensitive data (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation is strictly local: it requires an existing interactive or session-level account on the Windows endpoint and the underlying CWE-732 misconfiguration; there is no remote or unauthenticated vector, and no code execution or availability impact is claimed. Our independent assessment narrows the confidentiality component to Low (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) and stresses that the realistic outcome is tampering with client data and configuration rather than host compromise. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the vendor advisory is the only reference.
Incorrectly assigned permissions on critical resources shipped with Dell Trusted Device Client (all versions prior to 8.1.359.0) let a low-privileged local user write to or modify files, directories, registry keys, or service configuration belonging to the agent, enabling tampering with trusted-device state and, per the vendor vector, disclosure of sensitive data (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation is strictly local: it requires an existing interactive or session-level account on the Windows endpoint and the underlying CWE-732 misconfiguration; there is no remote or unauthenticated vector, and no code execution or availability impact is claimed. Our independent assessment narrows the confidentiality component to Low (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) and stresses that the realistic outcome is tampering with client data and configuration rather than host compromise. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the vendor advisory is the only reference.