Vulnerability in Dell Client Consumer And Commercial Platforms
CVE-2020-5324
Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utility during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (15.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 15.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Dell Client Consumer And Commercial Platforms — versions https://www.dell.com/support/article/SLN320348
- Dell G3 15 3590
- Dell G3 15 3590 Firmware
- Dell G3 3579
- Dell G3 3579 Firmware
- Dell G3 3779
- Dell G3 3779 Firmware
- Dell G5 15 5590
- Dell G5 15 5590 Firmware
- Dell G5 5090
Weakness classification (CWE)
References
- www.dell.com/support/article/SLN320348 (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-5324?
- CVE-2020-5324 is a high-severity vulnerability in Dell Client Consumer And Commercial Platforms, classified under Uncontrolled Search Path Element. CVSS score: 7.1/10. Published 2020-02-21.
- How severe is CVE-2020-5324?
- High severity. CVSS v3 base score is 7.1 out of 10.