Read the docs
TI-2021-14653 Aliases CVE-2021-36285GHSA-26ww-2c8f-2rgh

Missing brute-force protection in Dell CPG BIOS

Priority LOW 25CWE-307Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-307.

Summary

Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack.

Why it matters now

EPSS 0.00232 14th percentileScored 2026-11-07
Fix Fixed CPG BIOS (Dell): 1.7.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellCPG BIOSbefore 1.7.01.7.0Patch availableCNA
  • CPG BIOS VendorDell Affected before 1.7.0 Fixed in 1.7.0 Patch available CNA

CPE configurations NVD · 42

CPEVersionsRoleVendor
cpe:2.3:o:dell:latitude_5310_2-in-1_firmware:*:*:*:*:*:*:*:*before 1.7.0VulnerableDell
cpe:2.3:h:dell:latitude_5310_2-in-1:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_5320_firmware:*:*:*:*:*:*:*:*before 1.7.0VulnerableDell
cpe:2.3:h:dell:latitude_5320:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_5400_firmware:*:*:*:*:*:*:*:*before 1.7.1VulnerableDell
cpe:2.3:h:dell:latitude_5400:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_5411_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:latitude_5411:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_5500_firmware:*:*:*:*:*:*:*:*before 1.8.0VulnerableDell
cpe:2.3:h:dell:latitude_5500:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:latitude_5310_2-in-1_firmware:*:*:*:*:*:*:*:* Versions before 1.7.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_5310_2-in-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_5320_firmware:*:*:*:*:*:*:*:* Versions before 1.7.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_5320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_5400_firmware:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_5400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_5411_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_5411:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_5500_firmware:*:*:*:*:*:*:*:* Versions before 1.8.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_5500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Show 32 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:dell:latitude_5520_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:latitude_5520:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_5511_firmware:*:*:*:*:*:*:*:*before 1.7.1VulnerableDell
cpe:2.3:h:dell:latitude_5511:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_7212_rugged_extreme_tablet_firmware:*:*:*:*:*:*:*:*before 1.7.0VulnerableDell
cpe:2.3:h:dell:latitude_7212_rugged_extreme_tablet:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_7280_firmware:*:*:*:*:*:*:*:*before 1.9.1VulnerableDell
cpe:2.3:h:dell:latitude_7280:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_7320_firmware:*:*:*:*:*:*:*:*before 1.7.0VulnerableDell
cpe:2.3:h:dell:latitude_7320:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_7370_firmware:*:*:*:*:*:*:*:*before 1.7.1VulnerableDell
cpe:2.3:h:dell:latitude_7370:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_7420_firmware:*:*:*:*:*:*:*:*before 1.7.0VulnerableDell
cpe:2.3:h:dell:latitude_7420:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_7480_firmware:*:*:*:*:*:*:*:*before 1.7.1VulnerableDell
cpe:2.3:h:dell:latitude_7480:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_9410_firmware:*:*:*:*:*:*:*:*before 1.7.1VulnerableDell
cpe:2.3:h:dell:latitude_9410:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_9510_firmware:*:*:*:*:*:*:*:*before 1.7.0VulnerableDell
cpe:2.3:h:dell:latitude_9510:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:latitude_9520_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:latitude_9520:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_3080_firmware:*:*:*:*:*:*:*:*before 1.5.2VulnerableDell
cpe:2.3:h:dell:optiplex_3080:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_3280_aio_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableDell
cpe:2.3:h:dell:optiplex_3280_aio:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_7480_aio_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableDell
cpe:2.3:h:dell:optiplex_7480_aio:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:precision_3551_ffirmware:*:*:*:*:*:*:*:*before 1.6.2VulnerableDell
cpe:2.3:h:dell:precision_3551:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:precision_3640_tower_firmware:*:*:*:*:*:*:*:*before 1.7.1VulnerableDell
cpe:2.3:h:dell:precision_3640_tower:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:latitude_5520_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_5520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_5511_firmware:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_5511:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_7212_rugged_extreme_tablet_firmware:*:*:*:*:*:*:*:* Versions before 1.7.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_7212_rugged_extreme_tablet:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_7280_firmware:*:*:*:*:*:*:*:* Versions before 1.9.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_7280:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_7320_firmware:*:*:*:*:*:*:*:* Versions before 1.7.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_7320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_7370_firmware:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_7370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_7420_firmware:*:*:*:*:*:*:*:* Versions before 1.7.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_7420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_7480_firmware:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_7480:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_9410_firmware:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_9410:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_9510_firmware:*:*:*:*:*:*:*:* Versions before 1.7.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_9510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:latitude_9520_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:latitude_9520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_3080_firmware:*:*:*:*:*:*:*:* Versions before 1.5.2 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_3080:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_3280_aio_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_3280_aio:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_7480_aio_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_7480_aio:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:precision_3551_ffirmware:*:*:*:*:*:*:*:* Versions before 1.6.2 Vulnerable ·Dell
  • cpe:2.3:h:dell:precision_3551:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:precision_3640_tower_firmware:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:precision_3640_tower:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA CPG BIOS (Dell) Fixed in 1.7.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell CPG BIOS 1.7.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-14652 Missing brute-force protection in Dell CPG BIOSPriority LOW 25
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-36285
  2. 2026-10-03 Alias added: GHSA-26ww-2c8f-2rgh

References

Advisory 1

  • TI-2024-35208 Weak authentication in Dell Client Platform BIOS CVSS 3.1HIGH 8.2
  • TI-2022-14131 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 8.2
  • TI-2022-14130 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 8.2
  • TI-2022-10105 Dell BIOS versions contain an Insecure Automated Optimization vulnerability. CVSS 3.1HIGH 7.9
  • TI-2022-14135 Stack-based buffer overflow in Dell CPG BIOS CVSS 3.1HIGH 7.8
  • TI-2022-14129 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 7.8
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences