Skip to content
Fencer Intel
high 8.6

CVE-2020-5363 json

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's mana…

published 6y ago modified 4mo ago also EUVD-2020-26545

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.

Patch / fix

  • dell latitude_5300_firmware 1.9.4
  • dell latitude_5300_2-in-1_firmware 1.9.4
  • dell latitude_5400_firmware 1.7.4
  • dell latitude_5401_firmware 1.8.4
  • dell latitude_5500_firmware 1.7.4
  • dell latitude_5501_firmware 1.8.4
  • dell latitude_7200_2_in_1_firmware 1.8.0
  • dell latitude_7220_firmware 1.6.0
  • dell latitude_7220ex_rugged_extreme_tablet_firmware 1.6.0
  • dell latitude_7300_firmware 1.7.4
  • dell latitude_7400_firmware 1.7.4
  • dell precision_3540_firmware 1.7.4
  • dell precision_3541_firmware 1.8.4
  • dell precision_7540_firmware 1.9.0
  • dell precision_7740_firmware 1.9.0
  • dell xps_13_9300_firmware 1.0.11
  • dell xps_7390_2-in-1_firmware 1.4.0
  • dell xps_7590_firmware 1.7.0

Is CVE-2020-5363 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Dell Dell Client Consumer and Commercial platforms

Classification

Weakness
  • CWE-158 Improper Neutralization of Null Byte or NUL Character

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.