CVE-2020-5363: Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface…

medium6.7CVSS 3.1

AVLACLPRHUINSUCHIHAH

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.

Affected

19 ranges

Vendor	Product	Version range	Fixed in
dell	dell_client_consumer_and_commercial_platforms	—	—
dell	latitude_5300_2-in-1_firmware	< 1.9.4	1.9.4
dell	latitude_5300_firmware	< 1.9.4	1.9.4
dell	latitude_5400_firmware	< 1.7.4	1.7.4
dell	latitude_5401_firmware	< 1.8.4	1.8.4
dell	latitude_5500_firmware	< 1.7.4	1.7.4
dell	latitude_5501_firmware	< 1.8.4	1.8.4
dell	latitude_7200_2_in_1_firmware	< 1.8.0	1.8.0
dell	latitude_7220_firmware	< 1.6.0	1.6.0
dell	latitude_7220ex_rugged_extreme_tablet_firmware	< 1.6.0	1.6.0
dell	latitude_7300_firmware	< 1.7.4	1.7.4
dell	latitude_7400_firmware	< 1.7.4	1.7.4
dell	precision_3540_firmware	< 1.7.4	1.7.4
dell	precision_3541_firmware	< 1.8.4	1.8.4
dell	precision_7540_firmware	< 1.9.0	1.9.0
dell	precision_7740_firmware	< 1.9.0	1.9.0
dell	xps_13_9300_firmware	< 1.0.11	1.0.11
dell	xps_7390_2-in-1_firmware	< 1.4.0	1.4.0
dell	xps_7590_firmware	< 1.7.0	1.7.0