Dell SupportAssist OS Recovery Multiple Vulnerabilities (DSA-2025-315)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(245591);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-38747", "CVE-2025-38746");
  script_xref(name:"IAVA", value:"2025-A-0566-S");

  script_name(english:"Dell SupportAssist OS Recovery Multiple Vulnerabilities (DSA-2025-315)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host contains a Dell SupportAssist OS Recovery install is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the version of Dell SupportAssist OS Recovery is affected by Multiple Vulnerabilities.

  - Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. 
    A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges. (CVE-2025-38747)

  - Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor 
    vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, 
    leading to Information Disclosure. (CVE-2025-38746)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.dell.com/support/kbdoc/en-us/000353093/dsa-2025-315");
  script_set_attribute(attribute:"solution", value:
"Update Dell SupportAssist OS Recovery version 5.5.14.0.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38747");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:dell:supportassist_os_recovery");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dell_supportassist_os_recovery_win_installed.nbin");
  script_require_keys("SMB/Registry/Enumerated", "installed_sw/Dell SupportAssist OS Recovery");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Dell SupportAssist OS Recovery', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        {'fixed_version' : '5.5.14.0'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);