The flaw is an incorrect permission assignment that allows a local user with low privileges to access critical resources managed by the Dell PowerProtect Agent Service. This can lead to the exposure of confidential data that the agent processes or stores, representing an information disclosure risk. The weakness corresponds to CWE‑732, which describes improper handling of permissions that permits unauthorized access to sensitive resources.

Dell PowerProtect Agent Service, versions earlier than 20.1, installed on Dell PowerProtect solutions that include the agent component. Systems that have not yet been upgraded to version 20.1 or later are affected.

The CVSS base score of 3.3 indicates low severity. The EPSS score is not available, leaving the likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires local access with a low‑privileged account, the threat is limited to systems that can be accessed physically or remotely with low‑privileged credentials. The overall risk is low to moderate, and remediation by patching is strongly recommended.