CVE-2020-5324: Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update…

PriorityP421medium4.4CVSS 3.1

AVLACHPRLUIRSUCNIHAN

EPSS

0.25%

16.6th percentile

Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utility during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers.

Affected

114 ranges· showing 25

Vendor	Product	Version range	Fixed in
dell	dell_client_consumer_and_commercial_platforms	—	—
dell	g3_15_3590_firmware	< 1.9.2	1.9.2
dell	g3_3579_firmware	< 1.11.0	1.11.0
dell	g3_3779_firmware	< 1.11.0	1.11.0
dell	g5_15_5590_firmware	< 1.11.1	1.11.1
dell	g5_5090_firmware	< 1.1.2	1.1.2
dell	g5_5587_firmware	< 1.12.2	1.12.2
dell	g7_15_7590_firmware	< 1.11.1	1.11.1
dell	g7_17_7790_firmware	< 1.11.1	1.11.1
dell	g7_7588_firmware	< 1.12.2	1.12.2
dell	inspiron_14_5490_firmware	< 1.4.0	1.4.0
dell	inspiron_3480_firmware	< 1.7.0	1.7.0
dell	inspiron_3481_firmware	< 1.6.0	1.6.0
dell	inspiron_3490_firmware	< 1.5.0	1.5.0
dell	inspiron_3493_firmware	< 1.4.0	1.4.0
dell	inspiron_3580_firmware	< 1.7.0	1.7.0
dell	inspiron_3581_firmware	< 1.6.0	1.6.0
dell	inspiron_3583_firmware	< 1.7.0	1.7.0
dell	inspiron_3584_firmware	< 1.6.0	1.6.0
dell	inspiron_3590_firmware	< 1.5.0	1.5.0
dell	inspiron_3593_firmware	< 1.4.0	1.4.0
dell	inspiron_3780_firmware	< 1.7.0	1.7.0
dell	inspiron_3781_firmware	< 1.6.0	1.6.0
dell	inspiron_3790_firmware	< 1.5.0	1.5.0
dell	inspiron_3793_firmware	< 1.4.0	1.4.0

CVSS provenance

nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

nvdv2.02.6LOWAV:L/AC:H/Au:N/C:N/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.