Medium severity · published Jun 10, 2020
CVE-2020-5363
Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of…
6.7
CVSS
0.3%
EPSS
No
On KEV
Description
Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
L5
Latitude 5300 2-in-1 Firmware · Dell
before 1.9.4 · source: NVD
L5
Latitude 5300 Firmware · Dell
before 1.9.4 · source: NVD
L5
Latitude 5400 Firmware · Dell
before 1.7.4 · source: NVD
L5
Latitude 5401 Firmware · Dell
before 1.8.4 · source: NVD
L5
Latitude 5500 Firmware · Dell
before 1.7.4 · source: NVD
L5
Latitude 5501 Firmware · Dell
before 1.8.4 · source: NVD
L7
Latitude 7200 2 IN 1 Firmware · Dell
before 1.8.0 · source: NVD
L7
Latitude 7220 Firmware · Dell
before 1.6.0 · source: NVD
L7
Latitude 7220ex Rugged Extreme Tablet Firmware · Dell
before 1.6.0 · source: NVD
L7
Latitude 7300 Firmware · Dell
before 1.7.4 · source: NVD
L7
Latitude 7400 Firmware · Dell
before 1.7.4 · source: NVD
P3
Precision 3540 Firmware · Dell
before 1.7.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5363
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5363
Vendor Advisory
https://www.dell.com/support/article/SLN321604
More from Latitude 5300 2-in-1 Firmware
8.2
CVE-2024-52541
Dell Client Platform BIOS contains a Weak Authentication vulnerability
6.7
CVE-2021-36283
Dell BIOS contains an improper input validation vulnerability
4.9
CVE-2023-48674
Dell Platform BIOS contains an Improper Null Termination vulnerability
4.4
CVE-2024-32855
Dell Client Platform BIOS contains an Out-of-bounds Write vulnerability in an externally developed component