{"id":"CVE-2025-38746","state":"PUBLISHED","title":"Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with p","description":"Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.","publishedAt":"2025-08-06T19:53:05.549Z","updatedAt":"2025-08-06T19:59:14.486Z","severity":{"score":3.5,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"dell"},"assigner":"dell","products":["Dell SupportAssist OS Recovery"],"affected":[{"vendor":"Dell","product":"SupportAssist OS Recovery","defaultStatus":"unaffected","versions":[{"version":"N/A","status":"affected","lessThan":"5.5.14.0","versionType":"semver"}]}],"references":["https://www.dell.com/support/kbdoc/en-us/000353093/dsa-2025-315"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38746.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-38746","state":"PUBLISHED","datePublished":"2025-08-06T19:53:05.549Z","dateUpdated":"2025-08-06T19:59:14.486Z","assignerShortName":"dell","assignerOrgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateReserved":"2025-04-16T05:03:52.415Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure."}],"affected":[{"vendor":"Dell","product":"SupportAssist OS Recovery","defaultStatus":"unaffected","versions":[{"version":"N/A","status":"affected","lessThan":"5.5.14.0","versionType":"semver"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000353093/dsa-2025-315","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"dell","orgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateUpdated":"2025-08-06T19:53:05.549Z"},"credits":[{"lang":"en","type":"finder","value":"Dell Technologies would like to thank bugzzzhunter for reporting this issue."}],"datePublic":"2025-08-06T17:00:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-06T19:58:35.164126Z","id":"CVE-2025-38746","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-06T19:59:14.486Z"}}]}}}