CVE-2021-21571

CWE-295 — Improper Certificate Validation3 documents3 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 49.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
129
Dell Alienware M15 R6 FirmwareDell Chengming 3990 FirmwareDell Chengming 3991 Firmware+126 more
Timeline
PublishedJun 24
Latest updateMay 24

Description

Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability using a person-in-the-middle attack which may lead to a denial of service and payload tampering.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:HExploitability: 1.6 | Impact: 4.2

Affected Packages129 packages

▶CVEListV5dell/uefi_bios_https_stackGen 11, Gen 10

🔴Vulnerability Details

2
GHSA
GHSA-g784-x97g-r6ww: Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerabi↗2022-05-24
▶
CVEList
CVE-2021-21571: Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerabi↗2021-06-24
▶