CVE-2020-5363
High
Description
Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.
SeverityHigh
CVSS8.6
Exploit probability—
ProductDell Latitude 5300 Firmware
PublishedJun 10, 2020
First seenJun 10, 2020
Weakness typeCWE-158CWE-158
How to fix
Update
- dell latitude_5300_firmware1.9.4 or later
- dell latitude_5300_2-in-1_firmware1.9.4 or later
- dell latitude_5400_firmware1.7.4 or later
- dell latitude_5401_firmware1.8.4 or later
- dell latitude_5500_firmware1.7.4 or later
- dell latitude_5501_firmware1.8.4 or later
- dell latitude_7200_2_in_1_firmware1.8.0 or later
- dell latitude_7220_firmware1.6.0 or later
- dell latitude_7220ex_rugged_extreme_tablet_firmware1.6.0 or later
- dell latitude_7300_firmware1.7.4 or later
- dell latitude_7400_firmware1.7.4 or later
- dell precision_3540_firmware1.7.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell latitude_5300_firmware | v < 1.9.4 | 1.9.4 |
| dell latitude_5300_2-in-1_firmware | v < 1.9.4 | 1.9.4 |
| dell latitude_5400_firmware | v < 1.7.4 | 1.7.4 |
| dell latitude_5401_firmware | v < 1.8.4 | 1.8.4 |
| dell latitude_5500_firmware | v < 1.7.4 | 1.7.4 |
| dell latitude_5501_firmware | v < 1.8.4 | 1.8.4 |
| dell latitude_7200_2_in_1_firmware | v < 1.8.0 | 1.8.0 |
| dell latitude_7220_firmware | v < 1.6.0 | 1.6.0 |
| dell latitude_7220ex_rugged_extreme_tablet_firmware | v < 1.6.0 | 1.6.0 |
| dell latitude_7300_firmware | v < 1.7.4 | 1.7.4 |
| dell latitude_7400_firmware | v < 1.7.4 | 1.7.4 |
| dell precision_3540_firmware | v < 1.7.4 | 1.7.4 |
| dell precision_3541_firmware | v < 1.8.4 | 1.8.4 |
| dell precision_7540_firmware | v < 1.9.0 | 1.9.0 |
| dell precision_7740_firmware | v < 1.9.0 | 1.9.0 |
| dell xps_13_9300_firmware | v < 1.0.11 | 1.0.11 |
| dell xps_7390_2-in-1_firmware | v < 1.4.0 | 1.4.0 |
| dell xps_7590_firmware | v < 1.7.0 | 1.7.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.