{"id":"CVE-2025-38746","aliases":["EUVD-2025-23869","GHSA-57v7-vhpq-cgvf"],"status":"published","title":"Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive...","description":"Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00209,"percentile":0.11181,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2025-08-06T19:53:05Z","modified":"2026-06-17T09:17:47Z","products":[{"vendor":"dell","product":"supportassist os recovery"},{"vendor":"dell","product":"supportassist_os_recovery"}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000353093/dsa-2025-315","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38746"},{"url":"https://github.com/advisories/GHSA-57v7-vhpq-cgvf"}],"sources":{"cve":[{"id":"CVE-2025-38746","description":"Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.","status":"published","published":"2025-08-06T19:53:05.549Z","modified":"2025-08-06T19:59:14.486Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:47.08757Z"}],"euvd":[{"id":"EUVD-2025-23869","description":"Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.","status":"published","published":"2025-08-06T19:53:05Z","modified":"2025-08-06T19:59:14Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:32:00.811941Z"}],"ghsa":[{"id":"GHSA-57v7-vhpq-cgvf","title":"Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive...","description":"Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.","status":"published","published":"2025-08-06T21:31:39Z","modified":"2025-08-06T21:31:46Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:03:12.284483Z"}],"nvd":[{"id":"CVE-2025-38746","description":"Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.","status":"published","published":"2025-08-06T20:15:27.94Z","modified":"2026-06-17T09:17:47.02Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:11:22.319351Z"}]}}