In the Linux kernel, a flaw in the Dell WMI Sysman driver causes the set_new_password() routine to hex‑dump the entire password buffer, exposing plaintext current and new passwords. This demonstrates an insecure handling of sensitive credential data (CWE‑256) that could allow an attacker to retrieve user passwords through the kernel's debug output.

The vulnerability affects the Linux kernel across all platforms where the Dell WMI Sysman driver is compiled. No specific kernel releases are enumerated, so it applies broadly to any install of the affected driver.

The CVSS score of 4.4 indicates a moderate severity, and the EPSS score of less than 1% suggests the likelihood of exploitation is low. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would require local access to the system with sufficient privileges to trigger the set_new_password() routine, likely through a WMI interface on Dell hardware. The attack vector is inferred as local privilege escalation rather than remote exploitation.