Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability.

Summary

Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.

Remediation

1. Inventory every Dell OS Recovery tool deployment, including staging.
2. Upgrade Dell OS Recovery tool to 2.4.4.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://www.dell.com/support/kbdoc/en-us/000515018/dsa-2026-445-security-update-for-dell-os-recovery-tool-for-multiple-vulnerabilities