The vulnerability arises from the use of plaintext storage for passwords within Dell Command | Configure (DCC). This flaw is a classic example of CWE-256 and allows a local attacker with low privileges to read stored credentials. When exploited, the attacker can disclose sensitive information that may be used for lateral movement or escalation, representing a moderate confidentiality impact.

This flaw affects Dell Command | Configure (DCC) versions earlier than 5.2.3.35. Systems running any pre‑5.2.3.35 release are at risk if they store administrator or service account passwords in the default configuration files. The vulnerability is vendor‑specific to Dell Command | Configure and is not known to affect other Dell products.

The CVSS score of 5.5 indicates moderate severity, while the lack of an EPSS score makes it unclear how frequently this vulnerability is exploited. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation. The likely attack vector is local access by a low privileged user, who can read the plaintext password files after logging in locally. Because the flaw requires local presence, network isolation can mitigate exposure, but any compromised local account remains a vulnerability.