Vulnerability in Dell Client Consumer And Commercial Platforms
CVE-2020-5363
Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (24.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 24th percentile — 24.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Dell Client Consumer And Commercial Platforms — versions https://www.dell.com/support/article/SLN321604
- Dell Latitude 5300
- Dell Latitude 5300 2-In-1
- Dell Latitude 5300 2-In-1 Firmware
- Dell Latitude 5300 Firmware
- Dell Latitude 5400
- Dell Latitude 5400 Firmware
- Dell Latitude 5401
- Dell Latitude 5401 Firmware
- Dell Latitude 5500
Weakness classification (CWE)
References
- www.dell.com/support/article/SLN321604 (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-5363?
- CVE-2020-5363 is a high-severity vulnerability in Dell Client Consumer And Commercial Platforms, classified under CWE-158. CVSS score: 8.6/10. Published 2020-06-10.
- How severe is CVE-2020-5363?
- High severity. CVSS v3 base score is 8.6 out of 10.