I contacted Demirkapi to chat about his research and the three unpatched local privilege escalation vulnerabilities in particular.

Still, a patch was released on April 1 that the HP Product Security Response Team (PSRT) said fixes 'potential escalation of privilege and arbitrary file deletion' with 'certain versions of HP Support Assistant.' This should automatically update HP Support Assistant software, but the software can also be updated manually by following the resolution instructions in the security bulletin published April 2.ĭemirkapi has an in-depth drill-down in his public disclosure, published April 3, which is worth a read if you want the technical minutiae.Īre you still at risk as an HP Support Assistant user? This was delayed because of the ongoing COVID-19 pandemic. However, he also noted that there were still unpatched vulnerabilities after this date and sent another report to HP on January 6, 2020, and another patch was scheduled for release in March.

An update meant to fix the problems was pushed out by HP on December 19, Demirkapi said. In his vulnerability disclosure, Demirkapi said he first reported his findings to HP on October 5, 2019.

Windows 7 switch user greyed out