Os Recovery Tool
Monthly
Command execution in Dell OS Recovery Tool versions prior to 2.4.4 arises from an untrusted search path condition (CWE-428) that lets a local attacker plant a malicious file in a location the tool resolves before its trusted path. The attacker needs local access to the host and the victim must actually launch the tool for the planted file to be loaded (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and code then runs only in the context of the user who started the application. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a conditional local risk rather than a mass-exploitation emergency; Dell's DSA-2026-445 advisory covers this and other flaws in the product.
Information disclosure in Dell's OS Recovery Tool (versions prior to 2.4.4) stems from a hard-coded cryptographic key embedded in the application (CWE-321), which an attacker who can extract it may use to recover data the key was intended to protect. Exploitation is gated by the CVSS vector's physical-access requirement (AV:P); no authentication (PR:N) or user interaction (UI:N) is needed once an attacker is at the machine, and impact is confined to partial confidentiality loss (C:L) with no integrity or availability effect, giving a low 2.4 base score and a 'monitor' priority. No public exploit code was identified at time of analysis, and installations on 2.4.4 or later are not affected.
Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell OS Recovery Tool, versions 2.2.4013 and 2.3.7012.0, contain an Improper Access Control Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Command execution in Dell OS Recovery Tool versions prior to 2.4.4 arises from an untrusted search path condition (CWE-428) that lets a local attacker plant a malicious file in a location the tool resolves before its trusted path. The attacker needs local access to the host and the victim must actually launch the tool for the planted file to be loaded (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and code then runs only in the context of the user who started the application. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a conditional local risk rather than a mass-exploitation emergency; Dell's DSA-2026-445 advisory covers this and other flaws in the product.
Information disclosure in Dell's OS Recovery Tool (versions prior to 2.4.4) stems from a hard-coded cryptographic key embedded in the application (CWE-321), which an attacker who can extract it may use to recover data the key was intended to protect. Exploitation is gated by the CVSS vector's physical-access requirement (AV:P); no authentication (PR:N) or user interaction (UI:N) is needed once an attacker is at the machine, and impact is confined to partial confidentiality loss (C:L) with no integrity or availability effect, giving a low 2.4 base score and a 'monitor' priority. No public exploit code was identified at time of analysis, and installations on 2.4.4 or later are not affected.
Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell OS Recovery Tool, versions 2.2.4013 and 2.3.7012.0, contain an Improper Access Control Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.