CVE-2023-43078 is a medium severity (CVSS 6.7) improper link resolution flaw in Dell Dock Firmware and Dell Client Platform. During installation it can lead to arbitrary folder deletion, with privilege escalation or denial of service as the outcome. Dell's advisory DSA-2023-362 lists fixed versions, so check it and update.
What's affected
The record names the Intel Thunderbolt controller firmware update utility and Dell client models, including the G15 5510 and G3 3500, among its affected product entries. Its description says Dell Dock Firmware and Dell Client Platform contain an improper link resolution vulnerability during installation.
The record gives no version numbers. Its single reference is Dell's advisory DSA-2023-362. When I fetched it, Dell's site denied access, so I could not read the fixed versions or the full list of affected models. Open the advisory in a browser, find your model and dock, and note the versions it requires.
The weakness is CWE-59, link following. The vector needs a local, low privilege account and some user interaction, with high attack complexity. The NVD record was published on August 28, 2024.
How to check if you're exposed
On Windows, find out which Dell dock firmware and client platform packages are installed and compare them with the versions in the advisory. Dell Command Update lists available firmware for each machine. From PowerShell you can list installed Dell packages:
Get-Package | Where-Object Name -like '*Dell*' | Select-Object Name, Version
Match each result with the advisory's table. If you manage many machines, use your endpoint tool to pull the same inventory.
What to do now
- Open Dell advisory DSA-2023-362 and note the models, packages and fixed versions it lists.
- Inventory Dell laptops and docks in your fleet and match them against the advisory.
- Update dock firmware and the client platform packages through Dell Command Update or your normal deployment tool.
- Run installers only from sources you trust, and avoid running them from user writable folders.
- Keep standard users from running firmware installers that need elevated rights.
Why it matters
Link resolution bugs happen when a privileged installer or service follows a link, such as a junction or symbolic link, planted by a low privilege user. The privileged process then acts on the target of the link. Here the stated outcome is arbitrary folder deletion, which an attacker can use to escalate privileges or to break the machine.
The class, CWE-59, is common in Windows installers and updaters, since they run with high rights and touch folders that users can sometimes write to. The medium score of 6.7 reflects high attack complexity and a need for user interaction. The KEV flag is false.
Quick check
What version fixes CVE-2023-43078?
The record does not give one, and Dell's advisory would not load for me. Check DSA-2023-362 for your model.
Sources
Last reviewed: 19 October 2026.
