Dell OS Recovery tool versions prior to 2.4.4 contain a use of Untrusted Search Path vulnerability (CWE-428). This flaw allows an unauthenticated local attacker to potentially execute arbitrary commands by exploiting the way the tool searches for executable files. The vulnerability has a high severity with a CVSS score of 7.8.