Login Request a demo
Medium severity · published Feb 21, 2020
CVE-2020-5326
Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C3
Chengming 3980 Firmware · Dell
before 2.13.0 · source: NVD
EB
Embedded Box PC 5000 Firmware · Dell
before 1.6.0 · source: NVD
G3
G3 3579 Firmware · Dell
before 1.10.0 · source: NVD
G3
G3 3590 Firmware · Dell
before 1.4.3 · source: NVD
G3
G3 3779 Firmware · Dell
before 1.10.0 · source: NVD
G5
G5 5587 Firmware · Dell
before 1.11.1 · source: NVD
G5
G5 5590 Firmware · Dell
before 1.8.0 · source: NVD
G7
G7 7588 Firmware · Dell
before 1.11.1 · source: NVD
G7
G7 7590 Firmware · Dell
before 1.8.0 · source: NVD
G7
G7 7790 Firmware · Dell
before 1.8.0 · source: NVD
I1
Inspiron 14 Gaming 7466 Firmware · Dell
before 1.5.0 · source: NVD
I1
Inspiron 14 Gaming 7467 Firmware · Dell
before 1.10.0 · source: NVD
Affected product
C3
Chengming 3980 Firmware
Dell
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5326
Vendor Advisory
https://www.dell.com/support/article/SLN320337
More from Chengming 3980 Firmware
7.8
CVE-2022-32493
Dell BIOS contains an Stack-Based Buffer Overflow vulnerability
7.8
CVE-2022-32491
Dell Client BIOS contains a Buffer Overflow vulnerability
7.8
CVE-2022-32489
Dell BIOS contains an improper input validation vulnerability
7.8
CVE-2022-32488
Dell BIOS contains an improper input validation vulnerability
7.8
CVE-2022-32487
Dell BIOS contains an improper input validation vulnerability