Read the docs
TI-2020-04434 Aliases CVE-2020-5387GHSA-jc6m-9rhv-q9wq

Improper handling of exceptional conditions in Dell CPG BIOS

Priority LOW 20CWE-755Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Dell XPS 13 9370 BIOS versions prior to 1.13.1 contains an Improper Exception Handling vulnerability. A local attacker with physical access could exploit this vulnerability to prevent the system from booting until the exploited boot device is removed.

Why it matters now

EPSS 0.00298 22nd percentileScored 2026-11-07
Fix Fixed CPG BIOS (Dell): 1.13.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellCPG BIOSbefore 1.13.11.13.1Patch availableCNA
  • CPG BIOS VendorDell Affected before 1.13.1 Fixed in 1.13.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:dell:xps_13_9370_firmware:*:*:*:*:*:*:*:*before 1.13.1VulnerableDell
cpe:2.3:h:dell:xps_13_9370:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:xps_13_9370_firmware:*:*:*:*:*:*:*:* Versions before 1.13.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:xps_13_9370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA CPG BIOS (Dell) Fixed in 1.13.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5387
  2. 2026-10-03 Alias added: GHSA-jc6m-9rhv-q9wq

References

Advisory 1

  • TI-2022-14131 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 8.2
  • TI-2022-14130 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 8.2
  • TI-2022-10105 Dell BIOS versions contain an Insecure Automated Optimization vulnerability. CVSS 3.1HIGH 7.9
  • TI-2022-14135 Stack-based buffer overflow in Dell CPG BIOS CVSS 3.1HIGH 7.8
  • TI-2022-14129 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 7.8
  • TI-2022-14127 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 7.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences