Threat Investigation
Request a demo

CVE-2021-36285

Medium

Description

Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack.

SeverityMedium
CVSS5.7
Exploit probability—
ProductDell Latitude 5310 2-in-1 Firmware
PublishedSep 28, 2021
First seenSep 28, 2021
Weakness typeCWE-307CWE-307

How to fix

Update
  • dell latitude_5310_2-in-1_firmware1.7.0 or later
  • dell latitude_5320_firmware1.7.0 or later
  • dell latitude_5400_firmware1.7.1 or later
  • dell latitude_5411_firmware1.6.0 or later
  • dell latitude_5500_firmware1.8.0 or later
  • dell latitude_5520_firmware1.6.0 or later
  • dell latitude_5511_firmware1.7.1 or later
  • dell latitude_7212_rugged_extreme_tablet_firmware1.7.0 or later
  • dell latitude_7280_firmware1.9.1 or later
  • dell latitude_7320_firmware1.7.0 or later
  • dell latitude_7370_firmware1.7.1 or later
  • dell latitude_7420_firmware1.7.0 or later

Affected products

ProductAffected versionsFixed in
dell latitude_5310_2-in-1_firmwarev < 1.7.01.7.0
dell latitude_5320_firmwarev < 1.7.01.7.0
dell latitude_5400_firmwarev < 1.7.11.7.1
dell latitude_5411_firmwarev < 1.6.01.6.0
dell latitude_5500_firmwarev < 1.8.01.8.0
dell latitude_5520_firmwarev < 1.6.01.6.0
dell latitude_5511_firmwarev < 1.7.11.7.1
dell latitude_7212_rugged_extreme_tablet_firmwarev < 1.7.01.7.0
dell latitude_7280_firmwarev < 1.9.11.9.1
dell latitude_7320_firmwarev < 1.7.01.7.0
dell latitude_7370_firmwarev < 1.7.11.7.1
dell latitude_7420_firmwarev < 1.7.01.7.0
dell latitude_7480_firmwarev < 1.7.11.7.1
dell latitude_9410_firmwarev < 1.7.11.7.1
dell latitude_9510_firmwarev < 1.7.01.7.0
dell latitude_9520_firmwarev < 1.6.01.6.0
dell optiplex_3080_firmwarev < 1.5.21.5.2
dell optiplex_3280_aio_firmwarev < 1.2.01.2.0
dell optiplex_7480_aio_firmwarev < 1.2.01.2.0
dell precision_3551_ffirmwarev < 1.6.21.6.2
dell precision_3640_tower_firmwarev < 1.7.11.7.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.