CVE-2026-70414: CWE-256: Plaintext Storage of a Password in Dell Command | Configure (DCC)

CVE-2026-70414 describes a plaintext storage of password vulnerability in Dell Command | Configure (DCC) software versions before 5.2.3.35. The weakness (CWE-256) allows an attacker with low privileges and local access to retrieve stored passwords in plaintext, leading to information disclosure. The CVSS 3.1 vector indicates the attack requires local access with low complexity and privileges, no user interaction, and impacts confidentiality with a high impact rating.

An attacker with local access and low privileges could exploit this vulnerability to obtain plaintext passwords stored by the software, resulting in unauthorized disclosure of sensitive credentials. This could facilitate further unauthorized access or lateral movement within the affected environment. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch links are provided, users should monitor Dell's advisories for updates. Until a fix is available, restrict local access to trusted users only and consider additional controls to protect stored credentials.