CVE-2020-5363

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.

Score

CVSS 3.1 8.6 High

Status

Modified - security_alert@emc.com

Published

2020-06-10

Last modified

2024-09-16

Weaknesses

CWE-158

Affected products

• Dell Client Consumer And Commercial Platforms (Dell)
• Latitude 5300 2-in-1 Firmware (Dell)
• Latitude 5300 Firmware (Dell)
• Latitude 5400 Firmware (Dell)
• Latitude 5401 Firmware (Dell)
• Latitude 5500 Firmware (Dell)
• Latitude 5501 Firmware (Dell)
• Latitude 7200 2 In 1 Firmware (Dell)
• Latitude 7220 Firmware (Dell)
• Latitude 7220ex Rugged Extreme Tablet Firmware (Dell)
• Latitude 7300 Firmware (Dell)
• Latitude 7400 Firmware (Dell)
• Precision 3540 Firmware (Dell)
• Precision 3541 Firmware (Dell)
• Precision 7540 Firmware (Dell)
• Precision 7740 Firmware (Dell)
• Xps 13 9300 Firmware (Dell)
• Xps 7390 2-in-1 Firmware (Dell)
• Xps 7590 Firmware (Dell)

References

• https://www.dell.com/support/article/SLN321604