CVE-2021-36285: Medium severity dell latitude 5310 2-in-1 firmware vulnerability
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Dell BIOS vulnerability?
The vulnerability ID for this Dell BIOS vulnerability is CVE-2021-36285.
What is the severity of CVE-2021-36285?
The severity of CVE-2021-36285 is medium, with a severity value of 4.4.
What is the affected software for CVE-2021-36285?
The affected software includes Dell Latitude 5310 2-in-1 Firmware up to version 1.7.0, Dell Latitude 5320 Firmware up to version 1.7.0, Dell Latitude 5400 Firmware up to version 1.7.1, Dell Latitude 5411 Firmware up to version 1.6.0, Dell Latitude 5500 Firmware up to version 1.8.0, Dell Latitude 5520 Firmware up to version 1.6.0, Dell Latitude 5511 Firmware up to version 1.7.1, Dell Latitude 7212 Rugged Extreme Tablet Firmware up to version 1.7.0, Dell Latitude 7280 Firmware up to version 1.9.1, Dell Latitude 7320 Firmware up to version 1.7.0, Dell Latitude 7370 Firmware up to version 1.7.1, Dell Latitude 7420 Firmware up to version 1.7.0, Dell Latitude 7480 Firmware up to version 1.7.1, Dell Latitude 9410 Firmware up to version 1.7.1, Dell Latitude 9510 Firmware up to version 1.7.0, Dell Latitude 9520 Firmware up to version 1.6.0, Dell Optiplex 3080 Firmware up to version 1.5.2, Dell Optiplex 3280 Aio Firmware up to version 1.2.0, Dell Optiplex 7480 Aio Firmware up to version 1.2.0, Dell Precision 3551 Ffirmware up to version 1.6.2, and Dell Precision 3640 Tower Firmware up to version 1.7.1.
How can an attacker exploit CVE-2021-36285?
A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack.
Is Dell Latitude 5310 2-in-1 vulnerable to CVE-2021-36285?
Yes, Dell Latitude 5310 2-in-1 Firmware up to version 1.7.0 is vulnerable to CVE-2021-36285.