CVE-2020-5326: dell chengming_3980_firmware

Vulnerability summary

CVE-2020-5326 is a medium (CVSS 6.1) vulnerability in dell chengming_3980_firmware. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.1% of scored vulnerabilities.

Timeline

1. 21-02-2020
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.