CVE-2020-5362 Missing authorization in Dell Client Consumer and Commercial platforms
Local attackers with admin privileges can bypass BIOS authentication to reset configuration to defaults on Dell platforms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-5362?
CVE-2020-5362 is a high-severity missing authorization vulnerability in Dell Chengming 3980 Firmware, published on 10 Jun 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which an unauthorized actor, with local system access with OS administrator privileges, could bypass the BIOS Administrator authentication to restore BIOS Setup configuration to default values.
Which versions are affected by CVE-2020-5362?
It affects 354 products.
Products include Dell Chengming 3967 Firmware, Dell Chengming 3977 Firmware, Dell Chengming 3980 Firmware, Dell Chengming 3988 Firmware, Dell Chengming 3990 Firmware, Dell Chengming 3991 Firmware and 348 more.
How do I fix CVE-2020-5362?
No fix has been published for CVE-2020-5362 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-5362 being exploited?
There is no known exploitation of CVE-2020-5362 in the wild and no public exploit code.
Other vulnerabilities in Dell Chengming 3980 Firmware
Sources
Also known as GHSA-xgch-xjh8-4m78.