CVE-2021-36285 — MEDIUM (5.7)

Q: How severe is CVE-2021-36285?

CVE-2021-36285 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2021-36285?

Check the references section above for vendor advisories and patch information. Affected products include: Dell Latitude 5310 2-In-1 Firmware, Dell Latitude 5310 2-In-1, Dell Latitude 5320 Firmware, Dell Latitude 5320, Dell Latitude 5400 Firmware.

Vulnerability Description

Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack.

CVSS Score

5.7

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Dell	Latitude 5310 2-In-1 Firmware	< 1.7.0
Dell	Latitude 5310 2-In-1	-
Dell	Latitude 5320 Firmware	< 1.7.0
Dell	Latitude 5320	-
Dell	Latitude 5400 Firmware	< 1.7.1
Dell	Latitude 5400	-
Dell	Latitude 5411 Firmware	< 1.6.0
Dell	Latitude 5411	-
Dell	Latitude 5500 Firmware	< 1.8.0
Dell	Latitude 5500	-
Dell	Latitude 5520 Firmware	< 1.6.0
Dell	Latitude 5520	-
Dell	Latitude 5511 Firmware	< 1.7.1
Dell	Latitude 5511	-
Dell	Latitude 7212 Rugged Extreme Tablet Firmware	< 1.7.0
Dell	Latitude 7212 Rugged Extreme Tablet	-
Dell	Latitude 7280 Firmware	< 1.9.1
Dell	Latitude 7280	-
Dell	Latitude 7320 Firmware	< 1.7.0
Dell	Latitude 7320	-

Related Weaknesses (CWE)

CWE-307

References

https://www.dell.com/support/kbdoc/000191495/Vendor Advisory
https://www.dell.com/support/kbdoc/000191495/Vendor Advisory

FAQ

What is CVE-2021-36285?

CVE-2021-36285 is a vulnerability with a CVSS score of 5.7 (MEDIUM). Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe p...

How severe is CVE-2021-36285?

CVE-2021-36285 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-36285?

Check the references section above for vendor advisories and patch information. Affected products include: Dell Latitude 5310 2-In-1 Firmware, Dell Latitude 5310 2-In-1, Dell Latitude 5320 Firmware, Dell Latitude 5320, Dell Latitude 5400 Firmware.