CVE-2021-21522 Auth bypass in CPG BIOS
A local attacker can reset the BIOS password via the Manageability Interface to access sensitive data on NVMe storage.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21522?
CVE-2021-21522 is a high-severity authentication bypass vulnerability in Dell Latitude 5290 2-in-1 Firmware, published on 28 Sep 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface.
Weakness: CWE-255
Which versions are affected by CVE-2021-21522?
It affects 28 products.
Products include Dell Latitude 5285 2-in-1 Firmware, Dell Latitude 5289 2-in-1 Firmware, Dell Latitude 5290 2-in-1 Firmware, Dell Latitude 5310 2-in-1 Firmware, Dell Latitude 7210 2-in-1 Firmware, Dell Latitude 7212 Rugged Extreme Tablet Firmware and 22 more.
How do I fix CVE-2021-21522?
No fix has been published for CVE-2021-21522 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-21522 being exploited?
There is no known exploitation of CVE-2021-21522 in the wild and no public exploit code.
Sources
Also known as GHSA-pg87-v27x-wx62.