Skip to content
Fencer Intel
medium 6.1

CVE-2020-5326 json

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage R…

published 6y ago modified 4mo ago also EUVD-2020-26508

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager.

Patch / fix

  • dell chengming_3980_firmware 2.13.0
  • dell g3_3579_firmware 1.10.0
  • dell g3_3590_firmware 1.4.3
  • dell g3_3779_firmware 1.10.0
  • dell g5_5587_firmware 1.11.1
  • dell g5_5590_firmware 1.8.0
  • dell g7_7588_firmware 1.11.1
  • dell g7_7590_firmware 1.8.0
  • dell g7_7790_firmware 1.8.0
  • dell embedded_box_pc_5000_firmware 1.6.0
  • dell inspiron_14_gaming_7466_firmware 1.5.0
  • dell inspiron_14_gaming_7467_firmware 1.10.0
  • dell inspiron_15_7572_firmware 1.2.1
  • dell inspiron_15_gaming_7566_firmware 1.5.0
  • dell inspiron_15_gaming_7567_firmware 1.10.0
  • dell inspiron_15_gaming_7577_firmware 1.8.0
  • dell inspiron_3470_firmware 2.13.0
  • dell inspiron_3480_firmware 1.5.1
  • dell inspiron_3481_firmware 1.4.0
  • dell inspiron_3580_firmware 1.5.1

Is CVE-2020-5326 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H
NVD 3.1 5.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • Dell Dell Client Consumer and Commercial Platforms

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.