DSA-2020-121: Dell Client Platform Security Update for BIOS Admin Password Change Verification Bypass Vulnerability

• Admin Password Change Verification Bypass Vulnerability

CVE-2020-5363

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.

8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products:

Dell Client Consumer and Commercial platforms (see Resolution section below for complete list of affected products)

Resolution:

The following is a list of impacted products and release dates. Dell recommends all customers update at the earliest opportunity.

We recommend customers follow security best practices and prevent unauthorized physical access to devices. Customers should ensure that OS protections are utilized, including OS Administrator password protections and OS login password to help prevent unauthorized access to the OS and the manageability interface. 

Please visit the Drivers and Downloads site for updates on the applicable products. Note, the following list of impacted products with released BIOS updates are linked. To learn more, visit the Dell Knowledge Base article Dell BIOS Updates, and download the update for your Dell computer.

Customers may use one of the Download notification applications to be notified and download driver, BIOS and firmware updates automatically once available.

 Notes:

• Prior to installing the update, please ensure Windows Updates are current
• The dates listed are estimated availability dates and are subject to change without notice.
• The platform list for Dell Client products will be updated periodically. Please check back frequently for the most up-to-date information.
• Update versions in the table below are the first releases with the updates to address the security vulnerabilities. Releases at and above these versions will include the security updates.
• Release dates below are in US format of MM/DD/YYYY.

Dell Client Consumer and Commercial Platforms Affected

The following is a list of impacted products and release dates: