CVE-2025-46685CWE-378

Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability

High · published January 13, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
1.1
In the wild
Unconfirmed
What it is

⚡ A local attacker can exploit a sneaky flaw in Dell SupportAssist OS Recovery, leading to elevated privileges! This inviting door is left ajar in versions before 5.5.15.1. 😱 Think of it like a hotel room where the cleaning staff accidentally leaves the door unlocked, allowing someone with a temporary badge to wander in and access the safe! Any low-privileged user with local access could take advantage of this. If exploited, a clever intruder could gain elevated permissions, allowing them to execute arbitrary commands or access sensitive data. This means they could potentially take control of critical system functions, which could be absolutely devastating to your security!

Put simply

Think of it like a hotel room where the cleaning staff accidentally leaves the door unlocked, allowing someone with a temporary badge to wander in and access the safe! Any low-privileged user with local access could take advantage of this. This vulnerability allows attackers to create temporary files with insecure permissions, which could lead to unauthorized privilege escalation in the affected version of Dell SupportAssist OS Recovery.

What to do

If exploited, a clever intruder could gain elevated permissions, allowing them to execute arbitrary commands or access sensitive data. This means they could potentially take control of critical system functions, which could be absolutely devastating to your security! Upgrade to version 5.5.15.1 or later immediately to close this exploit path. Additionally, review permissions on temporary files to ensure they adhere to best security practices. Regularly update your software to protect against similar vulnerabilities in the future. You've got this! Patch up and secure your systems like the hero you are! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00106 · 1.1th percentile
Weakness
CWE-378 · Creation of Temporary File With Insecure Permissions
Published
2026-01-13T16:36Z
EPSS history
Timeline
  • 13 JAN 16:36Z
    Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability
    cvelistv5