CVE-2021-36284
First published: Tue Sep 28 2021(Updated: )
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive admin password attempt mitigations in order to carry out a brute force attack.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dell Latitude 5310 2-in-1 Firmware | <1.7.0 | |
| Dell Latitude 5310 2-in-1 | ||
| Dell Latitude 5320 Firmware | <1.7.0 | |
| Dell Latitude 5320 | ||
| Dell Latitude 5400 Firmware | <1.7.1 | |
| Dell Latitude 5400 | ||
| Dell Latitude 5411 Firmware | <1.6.0 | |
| Dell Latitude 5411 | ||
| Dell Latitude 5500 Firmware | <1.8.0 | |
| Dell Latitude 5500 | ||
| Dell Latitude 5520 Firmware | <1.6.0 | |
| Dell Latitude 5520 | ||
| Dell Latitude 5511 Firmware | <1.7.1 | |
| Dell Latitude 5511 | ||
| Dell Latitude 7212 Rugged Extreme Tablet Firmware | <1.7.0 | |
| Dell Latitude 7212 Rugged Extreme Tablet | ||
| Dell Latitude 7280 Firmware | <1.9.1 | |
| Dell Latitude 7280 | ||
| Dell Latitude 7320 Firmware | <1.7.0 | |
| Dell Latitude 7320 | ||
| Dell Latitude 7370 Firmware | <1.7.1 | |
| Dell Latitude 7370 | ||
| Dell Latitude 7420 Firmware | <1.7.0 | |
| Dell Latitude 7420 | ||
| Dell Latitude 7480 Firmware | <1.7.1 | |
| Dell Latitude 7480 | ||
| Dell Latitude 9410 Firmware | <1.7.1 | |
| Dell Latitude 9410 | ||
| Dell Latitude 9510 Firmware | <1.7.0 | |
| Dell Latitude 9510 | ||
| Dell Latitude 9520 Firmware | <1.6.0 | |
| Dell Latitude 9520 | ||
| Dell Optiplex 3080 Firmware | <1.5.2 | |
| Dell Optiplex 3080 | ||
| Dell Optiplex 3280 Aio Firmware | <1.2.0 | |
| Dell Optiplex 3280 Aio | ||
| Dell Optiplex 7480 Aio Firmware | <1.2.0 | |
| Dell Optiplex 7480 Aio | ||
| Dell Precision 3551 Ffirmware | <1.6.2 | |
| Dell Precision 3551 | ||
| Dell Precision 3640 Tower Firmware | <1.7.1 | |
| Dell Precision 3640 Tower |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-36284?
CVE-2021-36284 is a vulnerability in Dell BIOS that allows a local authenticated malicious administrator to bypass excessive admin password attempt mitigations and perform a brute force attack.
Which Dell products are affected by CVE-2021-36284?
Dell Latitude 5310 2-in-1 Firmware up to version 1.7.0, Dell Latitude 5320 Firmware up to version 1.7.0, Dell Latitude 5400 Firmware up to version 1.7.1, Dell Latitude 5411 Firmware up to version 1.6.0, Dell Latitude 5500 Firmware up to version 1.8.0, Dell Latitude 5520 Firmware up to version 1.6.0, Dell Latitude 5511 Firmware up to version 1.7.1, Dell Latitude 7212 Rugged Extreme Tablet Firmware up to version 1.7.0, Dell Latitude 7280 Firmware up to version 1.9.1, Dell Latitude 7320 Firmware up to version 1.7.0, Dell Latitude 7370 Firmware up to version 1.7.1, Dell Latitude 7420 Firmware up to version 1.7.0, Dell Latitude 7480 Firmware up to version 1.7.1, Dell Latitude 9410 Firmware up to version 1.7.1, Dell Latitude 9510 Firmware up to version 1.7.0, Dell Latitude 9520 Firmware up to version 1.6.0, Dell Optiplex 3080 Firmware up to version 1.5.2, Dell Optiplex 3280 Aio Firmware up to version 1.2.0, Dell Optiplex 7480 Aio Firmware up to version 1.2.0, Dell Precision 3551 Ffirmware up to version 1.6.2, Dell Precision 3640 Tower Firmware up to version 1.7.1 are affected.
What is the severity of CVE-2021-36284?
CVE-2021-36284 has a severity value of 4.4, which is considered medium.
How can I fix CVE-2021-36284?
To fix CVE-2021-36284, Dell recommends updating the affected products to the latest firmware version available.
Where can I find more information about CVE-2021-36284?
You can find more information about CVE-2021-36284 on Dell's official support website: https://www.dell.com/support/kbdoc/000191495
- collector/nvd-index
- agent/author
- agent/tags
- agent/event
- agent/references
- agent/weakness
- agent/severity
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/dell
- canonical/dell latitude 5310 2-in-1 firmware
- canonical/dell latitude 5310 2-in-1
- canonical/dell latitude 5320 firmware
- canonical/dell latitude 5320
- canonical/dell latitude 5400 firmware
- canonical/dell latitude 5400
- canonical/dell latitude 5411 firmware
- canonical/dell latitude 5411
- canonical/dell latitude 5500 firmware
- canonical/dell latitude 5500
- canonical/dell latitude 5520 firmware
- canonical/dell latitude 5520
- canonical/dell latitude 5511 firmware
- canonical/dell latitude 5511
- canonical/dell latitude 7212 rugged extreme tablet firmware
- canonical/dell latitude 7212 rugged extreme tablet
- canonical/dell latitude 7280 firmware
- canonical/dell latitude 7280
- canonical/dell latitude 7320 firmware
- canonical/dell latitude 7320
- canonical/dell latitude 7370 firmware
- canonical/dell latitude 7370
- canonical/dell latitude 7420 firmware
- canonical/dell latitude 7420
- canonical/dell latitude 7480 firmware
- canonical/dell latitude 7480
- canonical/dell latitude 9410 firmware
- canonical/dell latitude 9410
- canonical/dell latitude 9510 firmware
- canonical/dell latitude 9510
- canonical/dell latitude 9520 firmware
- canonical/dell latitude 9520
- canonical/dell optiplex 3080 firmware
- canonical/dell optiplex 3080
- canonical/dell optiplex 3280 aio firmware
- canonical/dell optiplex 3280 aio
- canonical/dell optiplex 7480 aio firmware
- canonical/dell optiplex 7480 aio
- canonical/dell precision 3551 ffirmware
- canonical/dell precision 3551
- canonical/dell precision 3640 tower firmware
- canonical/dell precision 3640 tower