CVE-2019-3745: The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions…

PriorityP335high7.3CVSS 3.1

AVLACLPRLUIRSUCHIHAH

EPSS

0.29%

21.0th percentile

The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions prior to 2.4.0. This issue is exploitable only during the installation of the product by an administrator. A local authenticated low privileged user potentially could exploit this vulnerability by staging a malicious DLL in the search path of the installer prior to its execution by a local administrator. This would cause loading of the malicious DLL, which would allow the attacker to execute arbitrary code in the context of an administrator.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
dell	dell_encryption_enterprise	>= unspecified < 10.4.0	10.4.0
dell	dell_endpoint_security_suite_enterprise	>= unspecified < 2.4.0	2.4.0
dell	encryption	< 10.4.0	10.4.0
dell	endpoint_security_suite_enterprise	< 2.4.0	2.4.0

CVSS provenance

nvdv3.17.3HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

nvdv3.06.7MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.