Vulnerability · Published Jun 10, 2020 · Assigned by dell

CVE-2020-5363

High 8.6

In plain English

A high-severity security flaw in Dell Client Consumer and Commercial platforms from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.3%top 74.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.

Affected products (as reported)

Vendor	Product	Versions
Dell	Dell Client Consumer and Commercial platforms	https://www.dell.com/support/article/SLN321604

Weakness: CWE-158 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://www.dell.com/support/article/SLN321604 x_refsource_MISC