Select Dell Client Consumer and Commercial platforms include an issue that allows the…
Priority LOW 37CWE-158Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.
Why it matters now
EPSS 0.00324 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Dell Client Consumer and Commercial platforms | https://www.dell.com/support/article/SLN321604 | — | No fix listed | CNA |
- Dell Client Consumer and Commercial platforms VendorDell Affected https://www.dell.com/support/article/SLN321604 Fixed in — No fix listed CNA
CPE configurations NVD · 36
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:latitude_5300_firmware:*:*:*:*:*:*:*:* | before 1.9.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_5300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:latitude_5300_2-in-1_firmware:*:*:*:*:*:*:*:* | before 1.9.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_5300_2-in-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:latitude_5400_firmware:*:*:*:*:*:*:*:* | before 1.7.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_5400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:latitude_5401_firmware:*:*:*:*:*:*:*:* | before 1.8.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_5401:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:latitude_5500_firmware:*:*:*:*:*:*:*:* | before 1.7.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_5500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:latitude_5300_firmware:*:*:*:*:*:*:*:* Versions before 1.9.4 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_5300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:latitude_5300_2-in-1_firmware:*:*:*:*:*:*:*:* Versions before 1.9.4 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_5300_2-in-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:latitude_5400_firmware:*:*:*:*:*:*:*:* Versions before 1.7.4 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_5400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:latitude_5401_firmware:*:*:*:*:*:*:*:* Versions before 1.8.4 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_5401:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:latitude_5500_firmware:*:*:*:*:*:*:*:* Versions before 1.7.4 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_5500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Show 26 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:latitude_5501_firmware:*:*:*:*:*:*:*:* | before 1.8.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_5501:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:latitude_7200_2_in_1_firmware:*:*:*:*:*:*:*:* | before 1.8.0 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_7200_2_in_1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:latitude_7220_firmware:*:*:*:*:*:*:*:* | before 1.6.0 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_7220:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:latitude_7220ex_rugged_extreme_tablet_firmware:*:*:*:*:*:*:*:* | before 1.6.0 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_7220ex_rugged_extreme_tablet:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:latitude_7300_firmware:*:*:*:*:*:*:*:* | before 1.7.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_7300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:latitude_7400_firmware:*:*:*:*:*:*:*:* | before 1.7.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_7400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:precision_3540_firmware:*:*:*:*:*:*:*:* | before 1.7.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:precision_3540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:precision_3541_firmware:*:*:*:*:*:*:*:* | before 1.8.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:precision_3541:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:precision_7540_firmware:*:*:*:*:*:*:*:* | before 1.9.0 | Vulnerable | Dell |
| cpe:2.3:h:dell:precision_7540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:precision_7740_firmware:*:*:*:*:*:*:*:* | before 1.9.0 | Vulnerable | Dell |
| cpe:2.3:h:dell:precision_7740:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:xps_13_9300_firmware:*:*:*:*:*:*:*:* | before 1.0.11 | Vulnerable | Dell |
| cpe:2.3:h:dell:xps_13_9300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:xps_7390_2-in-1_firmware:*:*:*:*:*:*:*:* | before 1.4.0 | Vulnerable | Dell |
| cpe:2.3:h:dell:xps_7390_2-in-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:xps_7590_firmware:*:*:*:*:*:*:*:* | before 1.7.0 | Vulnerable | Dell |
| cpe:2.3:h:dell:xps_7590:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:latitude_5501_firmware:*:*:*:*:*:*:*:* Versions before 1.8.4 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_5501:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:latitude_7200_2_in_1_firmware:*:*:*:*:*:*:*:* Versions before 1.8.0 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_7200_2_in_1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:latitude_7220_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_7220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:latitude_7220ex_rugged_extreme_tablet_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_7220ex_rugged_extreme_tablet:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:latitude_7300_firmware:*:*:*:*:*:*:*:* Versions before 1.7.4 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_7300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:latitude_7400_firmware:*:*:*:*:*:*:*:* Versions before 1.7.4 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_7400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:precision_3540_firmware:*:*:*:*:*:*:*:* Versions before 1.7.4 Vulnerable ·Dell
- cpe:2.3:h:dell:precision_3540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:precision_3541_firmware:*:*:*:*:*:*:*:* Versions before 1.8.4 Vulnerable ·Dell
- cpe:2.3:h:dell:precision_3541:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:precision_7540_firmware:*:*:*:*:*:*:*:* Versions before 1.9.0 Vulnerable ·Dell
- cpe:2.3:h:dell:precision_7540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:precision_7740_firmware:*:*:*:*:*:*:*:* Versions before 1.9.0 Vulnerable ·Dell
- cpe:2.3:h:dell:precision_7740:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:xps_13_9300_firmware:*:*:*:*:*:*:*:* Versions before 1.0.11 Vulnerable ·Dell
- cpe:2.3:h:dell:xps_13_9300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:xps_7390_2-in-1_firmware:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·Dell
- cpe:2.3:h:dell:xps_7390_2-in-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:xps_7590_firmware:*:*:*:*:*:*:*:* Versions before 1.7.0 Vulnerable ·Dell
- cpe:2.3:h:dell:xps_7590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5363
- 2026-10-03 Alias added: GHSA-q6xh-6r5c-j5mc
References
More Dell Latitude 5300 2-in-1 Firmware vulnerabilities
- TI-2024-35208 Weak authentication in Dell Client Platform BIOS CVSS 3.1HIGH 8.2
- TI-2022-14131 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 8.2
- TI-2022-14130 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 8.2
- TI-2022-10105 Dell BIOS versions contain an Insecure Automated Optimization vulnerability. CVSS 3.1HIGH 7.9
- TI-2022-14135 Stack-based buffer overflow in Dell CPG BIOS CVSS 3.1HIGH 7.8
- TI-2022-14129 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 7.8
Sources
- CVE-2020-5363 · CVE Program
- CVE-2020-5363 · NVD
- FIRST EPSS
- GHSA-q6xh-6r5c-j5mc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences