Read the docs
TI-2020-04395 Aliases CVE-2020-5343GHSA-h6cx-vr2q-r4vv

Incorrect authorization in Dell CPG SW

Priority LOW 34CWE-277Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insecure inherited permissions vulnerability. A local authenticated malicious user with low privileges could exploit this vulnerability to gain unauthorized access on the root folder.

Why it matters now

EPSS 0.00273 19th percentileScored 2026-11-07
Fix Fixed CPG SW (Dell): Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellCPG SWbefore Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019Patch availableCNA
  • CPG SW VendorDell Affected before Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019 Fixed in Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:dell:os_recovery_image_for_microsoft_windows_10:*:*:*:*:*:*:*:*before 2019-12-20VulnerableDell
  • cpe:2.3:o:dell:os_recovery_image_for_microsoft_windows_10:*:*:*:*:*:*:*:* Versions before 2019-12-20 Vulnerable ·Dell

Remediation

  • Fix · CNA CPG SW (Dell) Fixed in Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5343
  2. 2026-10-03 Alias added: GHSA-h6cx-vr2q-r4vv

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences