OS Recovery Tool EUVD-2026-116487

Requires local physical access (AV:P) to a Dell system with the OS Recovery tool installed at a version prior to 2.4.4; the tool ships with a hard-coded cryptographic key (CWE-321), so an attacker who extracts that embedded key can disclose information it was meant to protect. No authentication is needed (PR:N) and no user interaction is required (UI:N), but the physical-access requirement is the decisive limiter: remote or network exploitation is not possible, impact is limited to confidentiality only (C:L, no integrity or availability effect), and installations updated to 2.4.4 or later are not affected.

This is a low-priority, low-real-risk issue despite being a cryptographic-key weakness (CWE-321). The CVSS 3.1 score of 2.4 (AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects the dominant limiting factor: AV:P means exploitation requires physical access to the machine, which collapses realistic attack surface dramatically. Impact is confined to low confidentiality (C:L) with no integrity or availability impact. The vuln.today decision label is 'monitor', the weakest urgency tier, and this is consistent with the signals: there is no CISA KEV listing, no EPSS score was supplied, and no PoC or exploit reference is present. No signals conflict - every indicator (physical-only vector, low confidentiality-only impact, 'monitor' label, absence of exploitation evidence) points the same direction. The one data caveat is the sole reference: it is a Dell BIOS advisory (DSA-2026-230, 'multiple AMI BIOS vulnerabilities'), which does not obviously correspond to the Dell OS Recovery Tool named in this CVE - verify the correct advisory with Dell before acting on remediation details.

An attacker with hands-on physical access to a Dell system running the OS Recovery tool (prior to 2.4.4) recovers a cryptographic key that is hard-coded into the software and identical across installations, then uses it to decrypt or access protected information handled by the tool. Because the key is embedded rather than per-device, knowledge of it generalizes across affected systems. No public exploit has been identified at time of analysis, and exploitation still requires local physical presence.