CVE-2021-36285
First published: Tue Sep 28 2021(Updated: )
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dell Latitude 5310 2-in-1 Firmware | <1.7.0 | |
| Dell Latitude 5310 2-in-1 | ||
| Dell Latitude 5320 Firmware | <1.7.0 | |
| Dell Latitude 5320 | ||
| Dell Latitude 5400 Firmware | <1.7.1 | |
| Dell Latitude 5400 | ||
| Dell Latitude 5411 Firmware | <1.6.0 | |
| Dell Latitude 5411 | ||
| Dell Latitude 5500 Firmware | <1.8.0 | |
| Dell Latitude 5500 | ||
| Dell Latitude 5520 Firmware | <1.6.0 | |
| Dell Latitude 5520 | ||
| Dell Latitude 5511 Firmware | <1.7.1 | |
| Dell Latitude 5511 | ||
| Dell Latitude 7212 Rugged Extreme Tablet Firmware | <1.7.0 | |
| Dell Latitude 7212 Rugged Extreme Tablet | ||
| Dell Latitude 7280 Firmware | <1.9.1 | |
| Dell Latitude 7280 | ||
| Dell Latitude 7320 Firmware | <1.7.0 | |
| Dell Latitude 7320 | ||
| Dell Latitude 7370 Firmware | <1.7.1 | |
| Dell Latitude 7370 | ||
| Dell Latitude 7420 Firmware | <1.7.0 | |
| Dell Latitude 7420 | ||
| Dell Latitude 7480 Firmware | <1.7.1 | |
| Dell Latitude 7480 | ||
| Dell Latitude 9410 Firmware | <1.7.1 | |
| Dell Latitude 9410 | ||
| Dell Latitude 9510 Firmware | <1.7.0 | |
| Dell Latitude 9510 | ||
| Dell Latitude 9520 Firmware | <1.6.0 | |
| Dell Latitude 9520 | ||
| Dell Optiplex 3080 Firmware | <1.5.2 | |
| Dell Optiplex 3080 | ||
| Dell Optiplex 3280 Aio Firmware | <1.2.0 | |
| Dell Optiplex 3280 Aio | ||
| Dell Optiplex 7480 Aio Firmware | <1.2.0 | |
| Dell Optiplex 7480 Aio | ||
| Dell Precision 3551 Ffirmware | <1.6.2 | |
| Dell Precision 3551 | ||
| Dell Precision 3640 Tower Firmware | <1.7.1 | |
| Dell Precision 3640 Tower |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Dell BIOS vulnerability?
The vulnerability ID for this Dell BIOS vulnerability is CVE-2021-36285.
What is the severity of CVE-2021-36285?
The severity of CVE-2021-36285 is medium, with a severity value of 4.4.
What is the affected software for CVE-2021-36285?
The affected software includes Dell Latitude 5310 2-in-1 Firmware up to version 1.7.0, Dell Latitude 5320 Firmware up to version 1.7.0, Dell Latitude 5400 Firmware up to version 1.7.1, Dell Latitude 5411 Firmware up to version 1.6.0, Dell Latitude 5500 Firmware up to version 1.8.0, Dell Latitude 5520 Firmware up to version 1.6.0, Dell Latitude 5511 Firmware up to version 1.7.1, Dell Latitude 7212 Rugged Extreme Tablet Firmware up to version 1.7.0, Dell Latitude 7280 Firmware up to version 1.9.1, Dell Latitude 7320 Firmware up to version 1.7.0, Dell Latitude 7370 Firmware up to version 1.7.1, Dell Latitude 7420 Firmware up to version 1.7.0, Dell Latitude 7480 Firmware up to version 1.7.1, Dell Latitude 9410 Firmware up to version 1.7.1, Dell Latitude 9510 Firmware up to version 1.7.0, Dell Latitude 9520 Firmware up to version 1.6.0, Dell Optiplex 3080 Firmware up to version 1.5.2, Dell Optiplex 3280 Aio Firmware up to version 1.2.0, Dell Optiplex 7480 Aio Firmware up to version 1.2.0, Dell Precision 3551 Ffirmware up to version 1.6.2, and Dell Precision 3640 Tower Firmware up to version 1.7.1.
How can an attacker exploit CVE-2021-36285?
A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack.
Is Dell Latitude 5310 2-in-1 vulnerable to CVE-2021-36285?
Yes, Dell Latitude 5310 2-in-1 Firmware up to version 1.7.0 is vulnerable to CVE-2021-36285.
- collector/nvd-index
- agent/event
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/dell
- canonical/dell latitude 5310 2-in-1 firmware
- canonical/dell latitude 5310 2-in-1
- canonical/dell latitude 5320 firmware
- canonical/dell latitude 5320
- canonical/dell latitude 5400 firmware
- canonical/dell latitude 5400
- canonical/dell latitude 5411 firmware
- canonical/dell latitude 5411
- canonical/dell latitude 5500 firmware
- canonical/dell latitude 5500
- canonical/dell latitude 5520 firmware
- canonical/dell latitude 5520
- canonical/dell latitude 5511 firmware
- canonical/dell latitude 5511
- canonical/dell latitude 7212 rugged extreme tablet firmware
- canonical/dell latitude 7212 rugged extreme tablet
- canonical/dell latitude 7280 firmware
- canonical/dell latitude 7280
- canonical/dell latitude 7320 firmware
- canonical/dell latitude 7320
- canonical/dell latitude 7370 firmware
- canonical/dell latitude 7370
- canonical/dell latitude 7420 firmware
- canonical/dell latitude 7420
- canonical/dell latitude 7480 firmware
- canonical/dell latitude 7480
- canonical/dell latitude 9410 firmware
- canonical/dell latitude 9410
- canonical/dell latitude 9510 firmware
- canonical/dell latitude 9510
- canonical/dell latitude 9520 firmware
- canonical/dell latitude 9520
- canonical/dell optiplex 3080 firmware
- canonical/dell optiplex 3080
- canonical/dell optiplex 3280 aio firmware
- canonical/dell optiplex 3280 aio
- canonical/dell optiplex 7480 aio firmware
- canonical/dell optiplex 7480 aio
- canonical/dell precision 3551 ffirmware
- canonical/dell precision 3551
- canonical/dell precision 3640 tower firmware
- canonical/dell precision 3640 tower