CVE-2020-5357
Description
Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerability is limited to the Dell Dock Firmware Update Utilities during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers.
How to fix
- dell dock_wd15_firmware1.0.8 or later
- dell dock_wd19_firmware1.0.14 or later
- dell thunderbolt_dock_tb16_firmware1.0.4 or later
- dell precision_dual_usb-c_thunderbolt_dock_-_tb18dc_firmware1.0.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell dock_wd15_firmware | v < 1.0.8 | 1.0.8 |
| dell dock_wd19_firmware | v < 1.0.14 | 1.0.14 |
| dell thunderbolt_dock_tb16_firmware | v < 1.0.4 | 1.0.4 |
| dell precision_dual_usb-c_thunderbolt_dock_-_tb18dc_firmware | v < 1.0.10 | 1.0.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.