VulnerabilityModified
CVE-2021-21522
A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface.
MEDIUM 4.4EPSS 0.23%
Does this matter?
Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.
Description
Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface.
- CVSS 3.1
- 4.4 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.23% probability · 14th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-255
- Affected
- dell/latitude 5285 2-in-1 firmware · dell/latitude 5289 2-in-1 firmware · dell/latitude 5310 2-in-1 firmware · dell/latitude 5290 2-in-1 firmware · dell/latitude 7210 2-in-1 firmware · dell/latitude 7212 rugged extreme tablet firmware · dell/latitude 7280 firmware · dell/latitude 7290 firmware · dell/latitude 7285 firmware · dell/latitude 7370 firmware · dell/latitude 7310 firmware · dell/latitude 7380 firmware · dell/latitude 7389 firmware · dell/latitude 7390 firmware · dell/latitude 7410 firmware · dell/latitude 7390 2-in-1 firmware · dell/latitude 7420 firmware · dell/latitude 7480 firmware · dell/latitude 7490 firmware · dell/latitude 9410 firmware · +8 more
- Source
- security_alert@emc.com
References
- https://www.dell.com/support/kbdoc/000191495Vendor Advisory
- https://www.dell.com/support/kbdoc/000191495Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.