Security readout for executives and security teams
Plain-English summary
Dell SupportAssist Client Consumer 3.8 and 3.9 can load an untrusted DLL under specific local conditions. A successful attacker could gain code execution with high confidentiality, integrity, and availability impact. This is not a remote internet-facing flaw, but it matters on managed Windows fleets where affected SupportAssist versions remain installed.
Executive priority
Treat as a high-priority endpoint hygiene issue, especially for Windows fleets using Dell consumer support tooling. It is less urgent than remotely exploitable or KEV-listed vulnerabilities, but affected versions should be removed or updated because successful local abuse can have full system impact.
Technical view
CVE-2021-36297 is a CWE-426 untrusted search path issue in Dell SupportAssist Client Consumer 3.8 and 3.9. The CVSS 3.1 score is 7.8 with local attack vector, low complexity, low privileges, no user interaction, unchanged scope, and high CIA impact. The description ties exploitation to DLL planting/hijacking and a separate administrative action outside default SOSInstallerTool.exe installation behavior.
Likely exposure
Exposure is limited to systems running Dell SupportAssist Client Consumer versions 3.8 or 3.9. The issue is local, not directly network-exposed. Risk is highest where low-privileged users or malware can stage files locally and where the separate administrative action described by the CVE may occur.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not marked CISA KEV. The attack requires local conditions and involves arbitrary DLL loading through an untrusted search path. The source description also notes a separate administrative action is required and is not part of the default SOSInstallerTool.exe installation.
Researcher notes
The evidence supports a local DLL planting/hijacking condition in SupportAssist Client Consumer 3.8 and 3.9 only. The bundle does not provide exploit proof, fixed version details, or in-the-wild activity. Validation should focus on version inventory, Dell advisory alignment, and endpoint telemetry rather than assuming broader Dell product exposure.
Mitigation direction
- Inventory endpoints for Dell SupportAssist Client Consumer 3.8 and 3.9.
- Apply Dell’s SupportAssist Client Consumer security update guidance from DSA-2021-163.
- Upgrade affected installations to a vendor-supported fixed release where available.
- Remove affected SupportAssist installations if business policy does not require them.
- Restrict local write access to application and installer staging directories.
Validation and detection
- Confirm installed SupportAssist Client Consumer versions across managed endpoints.
- Verify affected 3.8 and 3.9 installations were updated or removed.
- Check endpoint management logs for successful remediation deployment.
- Review EDR telemetry for unusual DLL loads tied to SupportAssist paths.
- Track exceptions where affected versions remain installed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-426: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-36297 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilitiesCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Untrusted Search Path
Untrusted Search Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.