CVE-2021-21522 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2021-21522

Analyzed

More Info Official Page

Source-security_alert@emc.com

Published At-28 Sep, 2021 | 20:15

Updated At-30 Jun, 2023 | 17:51

Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.4	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Secondary	3.1	8.2	HIGH	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary	2.0	2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 4.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 8.2

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 2.1

Base severity: LOW

Vector:

AV:L/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

>>latitude_5285_2-in-1_firmware>>Versions before 1.13.0(exclusive)

cpe:2.3:o:dell:latitude_5285_2-in-1_firmware:*:*:*:*:*:*:*:*

>>latitude_5285_2-in-1>>*

cpe:2.3:h:dell:latitude_5285_2-in-1:*:*:*:*:*:*:*:*

>>latitude_5289_2-in-1_firmware>>Versions before 1.23.1(exclusive)

cpe:2.3:o:dell:latitude_5289_2-in-1_firmware:*:*:*:*:*:*:*:*

>>latitude_5289_2-in-1>>*

cpe:2.3:h:dell:latitude_5289_2-in-1:*:*:*:*:*:*:*:*

>>latitude_5310_2-in-1_firmware>>1.7.0

cpe:2.3:o:dell:latitude_5310_2-in-1_firmware:1.7.0:*:*:*:*:*:*:*

>>latitude_5310_2-in-1>>*

cpe:2.3:h:dell:latitude_5310_2-in-1:*:*:*:*:*:*:*:*

>>latitude_5290_2-in-1_firmware>>Versions before 1.16.0(exclusive)

cpe:2.3:o:dell:latitude_5290_2-in-1_firmware:*:*:*:*:*:*:*:*

>>latitude_5290_2-in-1>>*

cpe:2.3:h:dell:latitude_5290_2-in-1:*:*:*:*:*:*:*:*

>>latitude_7210_2-in-1_firmware>>Versions before 1.7.0(exclusive)

cpe:2.3:o:dell:latitude_7210_2-in-1_firmware:*:*:*:*:*:*:*:*

>>latitude_7210_2-in-1>>-

cpe:2.3:h:dell:latitude_7210_2-in-1:-:*:*:*:*:*:*:*

>>latitude_7212_rugged_extreme_tablet_firmware>>Versions before 1.33.0(exclusive)

cpe:2.3:o:dell:latitude_7212_rugged_extreme_tablet_firmware:*:*:*:*:*:*:*:*

>>latitude_7212_rugged_extreme_tablet_firmware>>1.33.0

cpe:2.3:o:dell:latitude_7212_rugged_extreme_tablet_firmware:1.33.0:*:*:*:*:*:*:*

>>latitude_7212_rugged_extreme_tablet>>-

cpe:2.3:h:dell:latitude_7212_rugged_extreme_tablet:-:*:*:*:*:*:*:*

>>latitude_7280_firmware>>Versions before 1.21.1(exclusive)

cpe:2.3:o:dell:latitude_7280_firmware:*:*:*:*:*:*:*:*

>>latitude_7280_firmware>>1.21.1

cpe:2.3:o:dell:latitude_7280_firmware:1.21.1:*:*:*:*:*:*:*

>>latitude_7280>>-

cpe:2.3:h:dell:latitude_7280:-:*:*:*:*:*:*:*

>>latitude_7290_firmware>>Versions before 1.20.0(exclusive)

cpe:2.3:o:dell:latitude_7290_firmware:*:*:*:*:*:*:*:*

>>latitude_7290_firmware>>1.20.0

cpe:2.3:o:dell:latitude_7290_firmware:1.20.0:*:*:*:*:*:*:*

>>latitude_7290>>-

cpe:2.3:h:dell:latitude_7290:-:*:*:*:*:*:*:*

>>latitude_7285_firmware>>Versions before 1.11.0(exclusive)

cpe:2.3:o:dell:latitude_7285_firmware:*:*:*:*:*:*:*:*

>>latitude_7285_firmware>>1.11.0

cpe:2.3:o:dell:latitude_7285_firmware:1.11.0:*:*:*:*:*:*:*

>>latitude_7285>>-

cpe:2.3:h:dell:latitude_7285:-:*:*:*:*:*:*:*

>>latitude_7370_firmware>>Versions before 1.24.3(exclusive)

cpe:2.3:o:dell:latitude_7370_firmware:*:*:*:*:*:*:*:*

>>latitude_7370_firmware>>1.24.3

cpe:2.3:o:dell:latitude_7370_firmware:1.24.3:*:*:*:*:*:*:*

>>latitude_7370>>-

cpe:2.3:h:dell:latitude_7370:-:*:*:*:*:*:*:*

>>latitude_7310_firmware>>Versions before 1.7.0(exclusive)

cpe:2.3:o:dell:latitude_7310_firmware:*:*:*:*:*:*:*:*

>>latitude_7310>>-

cpe:2.3:h:dell:latitude_7310:-:*:*:*:*:*:*:*

>>latitude_7380_firmware>>1.21.1

cpe:2.3:o:dell:latitude_7380_firmware:1.21.1:*:*:*:*:*:*:*

>>latitude_7380>>-

cpe:2.3:h:dell:latitude_7380:-:*:*:*:*:*:*:*

>>latitude_7389_firmware>>Versions before 1.23.1(exclusive)

cpe:2.3:o:dell:latitude_7389_firmware:*:*:*:*:*:*:*:*

>>latitude_7389>>-

cpe:2.3:h:dell:latitude_7389:-:*:*:*:*:*:*:*

>>latitude_7390_firmware>>1.20.0

cpe:2.3:o:dell:latitude_7390_firmware:1.20.0:*:*:*:*:*:*:*

>>latitude_7390>>-

cpe:2.3:h:dell:latitude_7390:-:*:*:*:*:*:*:*

>>latitude_7410_firmware>>Versions before 1.7.0(exclusive)

cpe:2.3:o:dell:latitude_7410_firmware:*:*:*:*:*:*:*:*

>>latitude_7410>>-

cpe:2.3:h:dell:latitude_7410:-:*:*:*:*:*:*:*

>>latitude_7390_2-in-1_firmware>>Versions before 1.19.0(exclusive)

cpe:2.3:o:dell:latitude_7390_2-in-1_firmware:*:*:*:*:*:*:*:*

>>latitude_7390_2-in-1>>-

cpe:2.3:h:dell:latitude_7390_2-in-1:-:*:*:*:*:*:*:*

>>latitude_7420_firmware>>Versions before 1.7.1(exclusive)

cpe:2.3:o:dell:latitude_7420_firmware:*:*:*:*:*:*:*:*

>>latitude_7420>>-

cpe:2.3:h:dell:latitude_7420:-:*:*:*:*:*:*:*

>>latitude_7480_firmware>>Versions before 1.21.1(exclusive)

cpe:2.3:o:dell:latitude_7480_firmware:*:*:*:*:*:*:*:*

>>latitude_7480>>-

cpe:2.3:h:dell:latitude_7480:-:*:*:*:*:*:*:*

>>latitude_7490_firmware>>Versions before 1.20.1(exclusive)

cpe:2.3:o:dell:latitude_7490_firmware:*:*:*:*:*:*:*:*

>>latitude_7490>>-

cpe:2.3:h:dell:latitude_7490:-:*:*:*:*:*:*:*

>>latitude_9410_firmware>>Versions before 1.7.0(exclusive)

cpe:2.3:o:dell:latitude_9410_firmware:*:*:*:*:*:*:*:*

>>latitude_9410>>-

cpe:2.3:h:dell:latitude_9410:-:*:*:*:*:*:*:*

>>latitude_9510_firmware>>Versions before 1.6.0(exclusive)

cpe:2.3:o:dell:latitude_9510_firmware:*:*:*:*:*:*:*:*

>>latitude_9510>>-

cpe:2.3:h:dell:latitude_9510:-:*:*:*:*:*:*:*

>>precision_3640_tower_firmware>>Versions before 1.6.2(exclusive)

cpe:2.3:o:dell:precision_3640_tower_firmware:*:*:*:*:*:*:*:*

>>precision_3640_tower>>-

cpe:2.3:h:dell:precision_3640_tower:-:*:*:*:*:*:*:*

>>precision_5520_firmware>>Versions before 1.23.1(exclusive)

cpe:2.3:o:dell:precision_5520_firmware:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-255	Secondary	security_alert@emc.com

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-255

Type: Secondary

Source: security_alert@emc.com

References

Hyperlink	Source	Resource
https://www.dell.com/support/kbdoc/000191495	security_alert@emc.com	Vendor Advisory

Hyperlink: https://www.dell.com/support/kbdoc/000191495

Source: security_alert@emc.com

Resource:

Vendor Advisory