High severity · published Jan 4, 2021
CVE-2020-5361
Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customers who forget their passwords
7.6
CVSS
0.4%
EPSS
No
On KEV
Description
Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customers who forget their passwords. Dell is aware of unauthorized password generation tools that can generate BIOS recovery passwords. The tools, which are not authorized by Dell, can be used by a physically present attacker to reset BIOS passwords and BIOS-managed Hard Disk Drive (HDD) passwords. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to bypass security restrictions for BIOS Setup configuration, HDD access and BIOS pre-boot authentication.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
Cpg Bios · Dell
All versions, or not specified · source: NVD
Affected product
CB
Cpg Bios
Dell
More from Cpg Bios
8.8
CVE-2022-32492
Dell BIOS contains an improper input validation vulnerability
8.8
CVE-2022-32486
Dell BIOS contains an improper input validation vulnerability
7.8
CVE-2022-34391
Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability
7.8
CVE-2022-34390
Dell BIOS contains a use of uninitialized variable vulnerability
7.8
CVE-2022-32493
Dell BIOS contains an Stack-Based Buffer Overflow vulnerability