Medium severity · published Feb 21, 2020
CVE-2020-5324
Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability
4.4
CVSS
0.3%
EPSS
No
On KEV
Description
Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utility during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
G1
G3 15 3590 Firmware · Dell
before 1.9.2 · source: NVD
G3
G3 3579 Firmware · Dell
before 1.11.0 · source: NVD
G3
G3 3779 Firmware · Dell
before 1.11.0 · source: NVD
G1
G5 15 5590 Firmware · Dell
before 1.11.1 · source: NVD
G5
G5 5090 Firmware · Dell
before 1.1.2 · source: NVD
G5
G5 5587 Firmware · Dell
before 1.12.2 · source: NVD
G1
G7 15 7590 Firmware · Dell
before 1.11.1 · source: NVD
G1
G7 17 7790 Firmware · Dell
before 1.11.1 · source: NVD
G7
G7 7588 Firmware · Dell
before 1.12.2 · source: NVD
I1
Inspiron 14 5490 Firmware · Dell
before 1.4.0 · source: NVD
I3
Inspiron 3480 Firmware · Dell
before 1.7.0 · source: NVD
I3
Inspiron 3481 Firmware · Dell
before 1.6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5324
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5324
Vendor Advisory
https://www.dell.com/support/article/SLN320348
More from G3 15 3590 Firmware
7.8
CVE-2022-32493
Dell BIOS contains an Stack-Based Buffer Overflow vulnerability
7.8
CVE-2022-32491
Dell Client BIOS contains a Buffer Overflow vulnerability
7.8
CVE-2022-32489
Dell BIOS contains an improper input validation vulnerability
7.8
CVE-2022-32488
Dell BIOS contains an improper input validation vulnerability
7.8
CVE-2022-32487
Dell BIOS contains an improper input validation vulnerability
