CVE-2020-5326: Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology…

PriorityP424medium5.3CVSS 3.1

AVPACLPRNUINSCCNIHAN

EPSS

0.35%

27.2th percentile

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager.

Affected

175 ranges· showing 25

Vendor	Product	Version range	Fixed in
dell	chengming_3980_firmware	< 2.13.0	2.13.0
dell	dell_client_consumer_and_commercial_platforms	—	—
dell	embedded_box_pc_5000_firmware	< 1.6.0	1.6.0
dell	g3_3579_firmware	< 1.10.0	1.10.0
dell	g3_3590_firmware	< 1.4.3	1.4.3
dell	g3_3779_firmware	< 1.10.0	1.10.0
dell	g5_5587_firmware	< 1.11.1	1.11.1
dell	g5_5590_firmware	< 1.8.0	1.8.0
dell	g7_7588_firmware	< 1.11.1	1.11.1
dell	g7_7590_firmware	< 1.8.0	1.8.0
dell	g7_7790_firmware	< 1.8.0	1.8.0
dell	inspiron_14_gaming_7466_firmware	< 1.5.0	1.5.0
dell	inspiron_14_gaming_7467_firmware	< 1.10.0	1.10.0
dell	inspiron_15_7572_firmware	< 1.2.1	1.2.1
dell	inspiron_15_gaming_7566_firmware	< 1.5.0	1.5.0
dell	inspiron_15_gaming_7567_firmware	< 1.10.0	1.10.0
dell	inspiron_15_gaming_7577_firmware	< 1.8.0	1.8.0
dell	inspiron_3470_firmware	< 2.13.0	2.13.0
dell	inspiron_3480_firmware	< 1.5.1	1.5.1
dell	inspiron_3481_firmware	< 1.4.0	1.4.0
dell	inspiron_3580_firmware	< 1.5.1	1.5.1
dell	inspiron_3581_firmware	< 1.4.0	1.4.0
dell	inspiron_3583_firmware	< 1.5.1	1.5.1
dell	inspiron_3584_firmware	< 1.4.0	1.4.0
dell	inspiron_3670_firmware	< 2.13.0	2.13.0

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.