TI-2022-10109 Aliases CVE-2022-26865 GHSA-8q4m-mmx3-p9jx

Authentication bypass in Dell OS Recovery Tool

LOW 30CWE-288Published 2022-05-26 · Updated 2024-09-16

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability. An unauthenticated attacker with physical access to the system may exploit this vulnerability by bypassing OS Recovery authentication in order to run arbitrary code on the system as Administrator.

Why it matters now

EPSS 0.00303 23rd percentileScored 2026-11-07

Fix Fixed Dell OS Recovery Tool (Dell): 5.5.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Dell OS Recovery Tool	before 5.5.2	5.5.2	Patch available	CNA

Dell OS Recovery Tool VendorDell Affected before 5.5.2 Fixed in 5.5.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:supportassist_os_recovery:5.5.1:::::::*	5.5.1	Vulnerable	Dell

cpe:2.3:a:dell:supportassist_os_recovery:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Dell

Remediation

Fix · CNA Dell OS Recovery Tool (Dell) Fixed in 5.5.2

Timeline

2026-10-02 Threatist record created from CVE-2022-26865
2026-10-03 Alias added: GHSA-8q4m-mmx3-p9jx

References

Advisory 1

https://www.dell.com/support/kbdoc/en-us/000198780/dsa-2022-102

TI-2025-29363 Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of… CVSS 3.1HIGH 7.8
TI-2025-26080 Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of… CVSS 3.1HIGH 7.8
TI-2025-16371 Link following in Dell SupportAssist OS Recovery CVSS 3.1HIGH 7.8
TI-2025-29362 Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of… CVSS 3.1MEDIUM 6.6
TI-2025-29311 Dell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of… CVSS 3.1MEDIUM 5.5
TI-2025-26079 Information disclosure in Dell SupportAssist OS Recovery CVSS 3.1LOW 3.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences