CVE-2022-26865

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability. An unauthenticated attacker with physical access to the system may exploit this vulnerability by bypassing OS Recovery authentication in order to run arbitrary code on the system as Administrator.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288 CWE-287

Affected software

Vendor	Product	Versions
Dell	Dell OS Recovery Tool	>= unspecified, < 5.5.2

References

https://www.dell.com/support/kbdoc/en-us/000198780/dsa-2022-102Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000198780/dsa-2022-102Vendor Advisory

Timeline

Published: May 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-268665.5Dell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged network attacker could pot CVE-2022-268678.0PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, without any validation o CVE-2022-268687.8Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. An authenticated attacker could poten CVE-2022-268699.8Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potential CVE-2022-26879.8A vulnerability, which was classified as critical, was found in SourceCodester Gym Management System. Affected is an unknown function. The m CVE-2022-268709.8Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit CVE-2022-268719.8An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary fil CVE-2022-268728.8AMI Megarac Password reset interception via API CVE-2022-268738.2A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to t CVE-2022-268745.4lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde CVE-2022-268776.5Asana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick the Asana desktop app into loading a maliciou CVE-2022-268785.5drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed).