CVE-2020-5363: dell dell client consumer and commercial platforms

Vulnerability summary

CVE-2020-5363 is a high (CVSS 8.6) vulnerability in dell dell client consumer and commercial platforms. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24% of scored vulnerabilities.

Timeline

1. 10-06-2020
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.

• CWE-158Improper Neutralization of Null Byte or NUL CharacterThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.