CVE-2025-46602 Information disclosure in SupportAssist OS Recovery

Medium 4.4 Published 27 Oct 2025 Updated 27 Oct 2025

A local low-privileged attacker can access sensitive information exposed in externally accessible files within Dell SupportAssist OS Recovery.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-46602?

CVE-2025-46602 is a medium-severity vulnerability in Dell SupportAssist OS Recovery, published on 27 Oct 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Dell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

Weakness: CWE-538

Which versions are affected by CVE-2025-46602?

It affects 1 product.

Products include Dell Supportassist Os Recovery.

How do I fix CVE-2025-46602?

No fix has been published for CVE-2025-46602 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-46602 being exploited?

There is no known exploitation of CVE-2025-46602 in the wild and no public exploit code.

Sources

Also known as GHSA-w2x4-h6c7-m6mh.