CVE-2024-25958: 
NixOS vulnerability analysis and mitigation

Dell Grab for Windows, versions up to and including 5.0.4, contain a Weak Application Folder Permissions vulnerability identified as CVE-2024-25958. The vulnerability was disclosed on March 26, 2024, and affects the Dell Grab application for Windows operating systems (Dell Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 HIGH (NIST) and 6.7 MEDIUM (Dell) with vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-276 (Incorrect Default Permissions) and requires local access with authenticated user privileges to exploit (NVD).

If successfully exploited, this vulnerability can lead to multiple severe consequences including privilege escalation, unauthorized access to application data, unauthorized modification of application data, and service disruption (Dell Advisory).

The vulnerability requires local access and authenticated user privileges to exploit. The attack complexity is considered high, and user interaction is required for successful exploitation (NVD).

Dell has released version 5.0.5 of Grab for Windows to address this vulnerability. Users are advised to upgrade to this version to mitigate the security risk. No additional workarounds have been provided (Dell Advisory).