Read the docs
TI-2020-16016 Aliases CVE-2020-26186GHSA-9rmr-65mh-rj57

Exposure of resource to wrong sphere in Dell CPG BIOS

Priority LOW 30CWE-642Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to system memory may exploit this vulnerability by overwriting the RuntimeServices structure to execute arbitrary code in System Management Mode (SMM).

Why it matters now

EPSS 0.0038 32nd percentileScored 2026-11-07
Fix Fixed CPG BIOS (Dell): 1.4.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellCPG BIOSbefore 1.4.11.4.1Patch availableCNA
  • CPG BIOS VendorDell Affected before 1.4.1 Fixed in 1.4.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:dell:inspiron_5675_firmware:*:*:*:*:*:*:*:*before 1.4.1VulnerableDell
cpe:2.3:h:dell:inspiron_5675:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:inspiron_5675_firmware:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5675:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA CPG BIOS (Dell) Fixed in 1.4.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26186
  2. 2026-10-03 Alias added: GHSA-9rmr-65mh-rj57

References

Advisory 1

  • TI-2022-08294 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 7.5
  • TI-2022-08293 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences