Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-21522: Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by rese...

CVE-2021-21522 · published 5 years ago

Summary

Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface.

What to do

Update dell latitude_5285_2-in-1_firmware to version 1.13.0 or later.
Update dell latitude_5289_2-in-1_firmware to version 1.23.1 or later.
Update dell latitude_5290_2-in-1_firmware to version 1.16.0 or later.
Update dell latitude_7210_2-in-1_firmware to version 1.7.0 or later.
Update dell latitude_7212_rugged_extreme_tablet_firmware to version 1.33.0 or later.
Update dell latitude_7280_firmware to version 1.21.1 or later.
Update dell latitude_7290_firmware to version 1.20.0 or later.
Update dell latitude_7285_firmware to version 1.11.0 or later.
Update dell latitude_7370_firmware to version 1.24.3 or later.
Update dell latitude_7310_firmware to version 1.7.0 or later.
Update dell latitude_7389_firmware to version 1.23.1 or later.
Update dell latitude_7410_firmware to version 1.7.0 or later.
Update dell latitude_7390_2-in-1_firmware to version 1.19.0 or later.
Update dell latitude_7420_firmware to version 1.7.1 or later.
Update dell latitude_7480_firmware to version 1.21.1 or later.
Update dell latitude_7490_firmware to version 1.20.1 or later.
Update dell latitude_9410_firmware to version 1.7.0 or later.
Update dell latitude_9510_firmware to version 1.6.0 or later.
Update dell precision_3640_tower_firmware to version 1.6.2 or later.
Update dell precision_5520_firmware to version 1.23.1 or later.
Update dell precision_5510_firmware to version 1.17.0 or later.
Update dell precision_5530_2-in-1_firmware to version 1.14.10 or later.
Update dell xps_13_9360_firmware to version 2.16.0 or later.
Update dell xps_13_9370_firmware to version 1.15.0 or later.
Update dell xps_15_9575_2-in-1_firmware to version 1.16.2 or later.

Affected software

Vendor	Product	Affected versions
dell	latitude_5285_2-in-1_firmware	< 1.13.0 `cpe:2.3:o:dell:latitude_5285_2-in-1_firmware::::::::`
dell	latitude_5289_2-in-1_firmware	< 1.23.1 `cpe:2.3:o:dell:latitude_5289_2-in-1_firmware::::::::`
dell	latitude_5310_2-in-1_firmware	1.7.0 `cpe:2.3:o:dell:latitude_5310_2-in-1_firmware:1.7.0:::::::*`
dell	latitude_5290_2-in-1_firmware	< 1.16.0 `cpe:2.3:o:dell:latitude_5290_2-in-1_firmware::::::::`
dell	latitude_7210_2-in-1_firmware	< 1.7.0 `cpe:2.3:o:dell:latitude_7210_2-in-1_firmware::::::::`
dell	latitude_7212_rugged_extreme_tablet_firmware	< 1.33.0 1.33.0 `cpe:2.3:o:dell:latitude_7212_rugged_extreme_tablet_firmware::::::::`
dell	latitude_7280_firmware	< 1.21.1 1.21.1 `cpe:2.3:o:dell:latitude_7280_firmware::::::::`
dell	latitude_7290_firmware	< 1.20.0 1.20.0 `cpe:2.3:o:dell:latitude_7290_firmware::::::::`
dell	latitude_7285_firmware	< 1.11.0 1.11.0 `cpe:2.3:o:dell:latitude_7285_firmware::::::::`
dell	latitude_7370_firmware	< 1.24.3 1.24.3 `cpe:2.3:o:dell:latitude_7370_firmware::::::::`
dell	latitude_7310_firmware	< 1.7.0 `cpe:2.3:o:dell:latitude_7310_firmware::::::::`
dell	latitude_7380_firmware	1.21.1 `cpe:2.3:o:dell:latitude_7380_firmware:1.21.1:::::::*`
dell	latitude_7389_firmware	< 1.23.1 `cpe:2.3:o:dell:latitude_7389_firmware::::::::`
dell	latitude_7390_firmware	1.20.0 `cpe:2.3:o:dell:latitude_7390_firmware:1.20.0:::::::*`
dell	latitude_7410_firmware	< 1.7.0 `cpe:2.3:o:dell:latitude_7410_firmware::::::::`
dell	latitude_7390_2-in-1_firmware	< 1.19.0 `cpe:2.3:o:dell:latitude_7390_2-in-1_firmware::::::::`
dell	latitude_7420_firmware	< 1.7.1 `cpe:2.3:o:dell:latitude_7420_firmware::::::::`
dell	latitude_7480_firmware	< 1.21.1 `cpe:2.3:o:dell:latitude_7480_firmware::::::::`
dell	latitude_7490_firmware	< 1.20.1 `cpe:2.3:o:dell:latitude_7490_firmware::::::::`
dell	latitude_9410_firmware	< 1.7.0 `cpe:2.3:o:dell:latitude_9410_firmware::::::::`
dell	latitude_9510_firmware	< 1.6.0 `cpe:2.3:o:dell:latitude_9510_firmware::::::::`
dell	precision_3640_tower_firmware	< 1.6.2 `cpe:2.3:o:dell:precision_3640_tower_firmware::::::::`
dell	precision_5520_firmware	< 1.23.1 `cpe:2.3:o:dell:precision_5520_firmware::::::::`
dell	precision_5510_firmware	< 1.17.0 `cpe:2.3:o:dell:precision_5510_firmware::::::::`
dell	precision_5530_2-in-1_firmware	< 1.14.10 `cpe:2.3:o:dell:precision_5530_2-in-1_firmware::::::::`
dell	xps_13_9360_firmware	< 2.16.0 `cpe:2.3:o:dell:xps_13_9360_firmware::::::::`
dell	xps_13_9370_firmware	< 1.15.0 `cpe:2.3:o:dell:xps_13_9370_firmware::::::::`
dell	xps_15_9575_2-in-1_firmware	< 1.16.2 `cpe:2.3:o:dell:xps_15_9575_2-in-1_firmware::::::::`

Original advisory text

References

https://www.dell.com/support/kbdoc/000191495 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-255Credentials Management Errors

Timeline

Published28 Sep 2021

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2021-21522 · NVD

Track software like this

Free during beta