CVE-2021-21522
High
Description
Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface.
SeverityHigh
CVSS8.2
Exploit probability—
ProductDell Latitude 5285 2-in-1 Firmware
PublishedSep 28, 2021
First seenSep 28, 2021
Weakness typeCWE-255CWE-255
How to fix
Update
- dell latitude_5285_2-in-1_firmware1.13.0 or later
- dell latitude_5289_2-in-1_firmware1.23.1 or later
- dell latitude_5290_2-in-1_firmware1.16.0 or later
- dell latitude_7210_2-in-1_firmware1.7.0 or later
- dell latitude_7212_rugged_extreme_tablet_firmware1.33.0 or later
- dell latitude_7280_firmware1.21.1 or later
- dell latitude_7290_firmware1.20.0 or later
- dell latitude_7285_firmware1.11.0 or later
- dell latitude_7370_firmware1.24.3 or later
- dell latitude_7310_firmware1.7.0 or later
- dell latitude_7389_firmware1.23.1 or later
- dell latitude_7410_firmware1.7.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell latitude_5285_2-in-1_firmware | v < 1.13.0 | 1.13.0 |
| dell latitude_5289_2-in-1_firmware | v < 1.23.1 | 1.23.1 |
| dell latitude_5310_2-in-1_firmware | 1.7.0 | — |
| dell latitude_5290_2-in-1_firmware | v < 1.16.0 | 1.16.0 |
| dell latitude_7210_2-in-1_firmware | v < 1.7.0 | 1.7.0 |
| dell latitude_7212_rugged_extreme_tablet_firmware | v < 1.33.0, 1.33.0 | 1.33.0 |
| dell latitude_7280_firmware | v < 1.21.1, 1.21.1 | 1.21.1 |
| dell latitude_7290_firmware | v < 1.20.0, 1.20.0 | 1.20.0 |
| dell latitude_7285_firmware | v < 1.11.0, 1.11.0 | 1.11.0 |
| dell latitude_7370_firmware | v < 1.24.3, 1.24.3 | 1.24.3 |
| dell latitude_7310_firmware | v < 1.7.0 | 1.7.0 |
| dell latitude_7380_firmware | 1.21.1 | — |
| dell latitude_7389_firmware | v < 1.23.1 | 1.23.1 |
| dell latitude_7390_firmware | 1.20.0 | — |
| dell latitude_7410_firmware | v < 1.7.0 | 1.7.0 |
| dell latitude_7390_2-in-1_firmware | v < 1.19.0 | 1.19.0 |
| dell latitude_7420_firmware | v < 1.7.1 | 1.7.1 |
| dell latitude_7480_firmware | v < 1.21.1 | 1.21.1 |
| dell latitude_7490_firmware | v < 1.20.1 | 1.20.1 |
| dell latitude_9410_firmware | v < 1.7.0 | 1.7.0 |
| dell latitude_9510_firmware | v < 1.6.0 | 1.6.0 |
| dell precision_3640_tower_firmware | v < 1.6.2 | 1.6.2 |
| dell precision_5520_firmware | v < 1.23.1 | 1.23.1 |
| dell precision_5510_firmware | v < 1.17.0 | 1.17.0 |
| dell precision_5530_2-in-1_firmware | v < 1.14.10 | 1.14.10 |
| dell xps_13_9360_firmware | v < 2.16.0 | 2.16.0 |
| dell xps_13_9370_firmware | v < 1.15.0 | 1.15.0 |
| dell xps_15_9575_2-in-1_firmware | v < 1.16.2 | 1.16.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.