CVE-2023-25543

Vulnerability

The vulnerability is an improper authorization flaw in the Dell Power Manager (DPM) service, affecting all versions prior to 3.14 [1]. A low-privileged local user can exploit this weakness to perform unauthorized actions within the service, which normally would require higher privileges.

Exploitation

An attacker must already have low-privileged access to the system. No additional network access is required because the DPM service runs locally. The attacker leverages the improper authorization checks in the service to execute operations that the service would otherwise restrict, thereby escalating their privileges without needing any user interaction beyond initially gaining low-level access [1].

Impact

Successful exploitation allows the attacker to elevate their privileges on the affected system. The Dell advisory rates the impact as high, and the CVSS score supports this assessment. The attacker can gain control over power management functions or potentially abuse the service to achieve higher system privileges [1].

Mitigation

The vulnerability is fixed in Dell Power Manager version 3.14, which was released alongside the advisory on 2023-04-04 [1]. Users should update via the Dell driver download page (driver ID 8678v). No workarounds are provided by Dell [1].