Dell OS Recovery Tool EUVD-2026-101607

Exploitation requires all of the following: local physical access to a Dell machine that has Dell OS Recovery Tool prior to version 2.4.4 installed, an already-provisioned low-privileged local account (PR:L), and user interaction with the tool (UI:R) to trigger access to the insecurely stored data. Limiting factors are significant: the Physical attack vector (AV:P) rules out any remote or network-based exploitation, the tool must be present and in a vulnerable version, and only Low confidentiality data is exposed with no integrity or availability impact. These constraints confine realistic risk to an insider or someone with hands-on device access.

This is a low-priority vulnerability by every available signal. The CVSS base score is only 2.2, and the vector (CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) confirms the constraining factors: Physical attack vector (AV:P), an already-present low-privileged account (PR:L), and required user interaction (UI:R), yielding only Low confidentiality impact with no integrity or availability impact. No EPSS score, KEV listing, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The combination of required physical access plus local authentication plus user interaction makes mass or remote exploitation infeasible - this is not a scalable threat. The one internally notable choice is the Scope:Changed metric Dell assigned, implying the insecurely stored data (CWE-922) may grant access to resources beyond the tool itself; this is the only reason the score is not even lower. No signals conflict: all indicators (low CVSS, physical vector, absence of EPSS/KEV/POC) point consistently to a low real-world risk. The CVSS vector and the textual description also agree - both describe a local/physical, low-privilege scenario.

An attacker with physical access to a Dell computer and a low-privileged local account launches or interacts with the Dell OS Recovery Tool (version prior to 2.4.4) and reads sensitive information that the tool stored insecurely on disk. No public exploit code is identified, and the physical-access and user-interaction requirements make this a targeted, hands-on-keyboard scenario rather than a scalable attack.