Read the docs
TI-2020-04412 Aliases CVE-2020-5361GHSA-863x-vcg8-vghr

Weak password recovery in Dell CPG BIOS

Priority LOW 33CWE-640Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-640.

Summary

Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customers who forget their passwords. Dell is aware of unauthorized password generation tools that can generate BIOS recovery passwords. The tools, which are not authorized by Dell, can be used by a physically present attacker to reset BIOS passwords and BIOS-managed Hard Disk Drive (HDD) passwords. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to bypass security restrictions for BIOS Setup configuration, HDD access and BIOS pre-boot authentication.

Why it matters now

EPSS 0.00388 33rd percentileScored 2026-11-07
Fix Fixed CPG BIOS (Dell): All

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellCPG BIOSbefore AllAllPatch availableCNA
  • CPG BIOS VendorDell Affected before All Fixed in All Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:dell:cpg_bios:*:*:*:*:*:*:*:*all versionsVulnerableDell
  • cpe:2.3:o:dell:cpg_bios:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Dell

Remediation

  • Fix · CNA CPG BIOS (Dell) Fixed in All

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5361
  2. 2026-10-03 Alias added: GHSA-863x-vcg8-vghr

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences