Dell Device Management Agent (DDMA) stores user passwords in clear text on the file system, a weakness that falls under the category of plain text password storage (CWE‑256). If an attacker gains local access with high privilege, they can read these credentials and use them to log in to the agent or related services, effectively obtaining unauthorized access to the device. The vulnerability does not expose a direct remote code execution path, but it compromises confidentiality and the integrity of authentication credentials.

The flaw affects Dell Device Management Agent versions earlier than 26.02. Any system running those builds is vulnerable; newer builds contain the fix.

The CVSS score of 4.4 indicates a low severity, and the EPSS score of less than 1 percent shows that the likelihood of exploitation is very small. The vulnerability is not listed in the CISA KEV catalog. However, because exploitation requires local high‑privileged access, the risk is elevated within compromised or physically accessible environments. Attackers would need to compromise local credentials or gain local administrative privileges to read the plaintext file and obtain credentials for the agent. Once obtained, they could gain full control over the device management agent's functionality.