Dell OS Recovery Tool contains an insecure storage of sensitive information vulnerability that allows a low privileged attacker who has physical access to read data that should remain confidential. This flaw can lead to the disclosure of credentials, configuration files, or other protected information stored by the recovery tool.

Dell OS Recovery Tool, all operating systems supported by Dell, versions prior to 2.4.4 are affected. Users should verify the tool’s version and upgrade if it is older than 2.4.4.

The CVSS score of 2.2 signifies a low severity risk, and the vulnerability is not listed in CISA’s KEV catalog. Because the attacker requires physical access and low privileges, the likelihood of exploitation depends on inadequate physical security controls, but the risk remains low if such controls are present. No EPSS data is available to gauge exploitation probability for the current sample.