Skip to main content

Latitude 5400 Firmware CVE-2020-5326

MEDIUM
Missing Authentication for Critical Function (CWE-306)
2020-02-21 security_alert@emc.com
Authentication Bypass Dell Intel Latitude 5400 Firmware Latitude 5401 Firmware Latitude 5420 Rugged Firmware Latitude 5424 Rugged Firmware Latitude 5480 Firmware Latitude 5488 Firmware Latitude 5490 Firmware Latitude 5491 Firmware Latitude 5500 Firmware Latitude 5501 Firmware Latitude 5580 Firmware Latitude 5590 Firmware Latitude 5591 Firmware Embedded Box Pc 5000 Firmware Latitude 7280 Firmware Latitude 7290 Firmware Latitude 7300 Firmware Latitude 7380 Firmware Latitude 7390 Firmware Latitude 7400 Firmware Latitude 7424 Rugged Extreme Firmware Latitude 7480 Firmware Latitude 7490 Firmware Precision 5530 Firmware Precision 7520 Firmware Precision 7530 Firmware Precision 7540 Firmware Precision 7720 Firmware Precision 7730 Firmware Precision 7740 Firmware Optiplex 3070 Firmware Optiplex 5070 Firmware Optiplex 7070 Firmware Latitude 3300 Firmware Latitude 5290 Firmware Latitude 5300 Firmware Wyse 5070 Firmware Optiplex Xe3 Firmware Precision 3530 Firmware Precision 3540 Firmware Precision 3541 Firmware Xps 13 9350 Firmware Chengming 3980 Firmware G3 3579 Firmware G3 3779 Firmware G5 5587 Firmware G5 5590 Firmware G7 7588 Firmware G7 7590 Firmware G7 7790 Firmware Inspiron 3470 Firmware Inspiron 3480 Firmware Inspiron 3481 Firmware Inspiron 3580 Firmware Inspiron 3583 Firmware Inspiron 3581 Firmware Inspiron 3584 Firmware Inspiron 3780 Firmware Inspiron 3781 Firmware Inspiron 5370 Firmware Inspiron 5480 Firmware Inspiron 5481 Firmware Inspiron 5482 Firmware Inspiron 5570 Firmware Inspiron 5580 Firmware Inspiron 5582 Firmware Inspiron 5770 Firmware Inspiron 7380 Firmware Inspiron 7386 Firmware Inspiron 7472 Firmware Inspiron 7580 Firmware Inspiron 7586 Firmware Inspiron 7786 Firmware Latitude 3460 Firmware Latitude 3480 Firmware Latitude 3490 Firmware Latitude 3580 Firmware Latitude 3590 Firmware Latitude 5175 Firmware Latitude 5179 Firmware Latitude 5280 Firmware Latitude 5288 Firmware Latitude 5289 Firmware Latitude 5414 Firmware Latitude 7202 Firmware Latitude 7212 Firmware Latitude 7214 Firmware Latitude 7275 Firmware Latitude 7285 Firmware Latitude 7370 Firmware Latitude 7389 Firmware Latitude 7414 Firmware Latitude E5270 Firmware Latitude E5470 Firmware Latitude E5570 Firmware Latitude E7270 Firmware Latitude E7470 Firmware Optiplex 3040 Firmware Optiplex 3046 Firmware Optiplex 3050 Firmware Optiplex 3060 Firmware Optiplex 5040 Firmware Optiplex 5050 Firmware Optiplex 5060 Firmware Optiplex 7040 Firmware Optiplex 7050 Firmware Optiplex 7060 Firmware Precision 3420 Firmware Precision 3430 Firmware Precision 3510 Firmware Precision 3520 Firmware Precision 3620 Firmware Precision 3630 Firmware Precision 3930 Firmware Precision 5510 Firmware Precision 5520 Firmware Precision 5820 Firmware Precision 7510 Firmware Precision 7710 Firmware Precision 7820 Firmware Precision 7920 Firmware Vostro 7580 Firmware Vostro 3070 Firmware Vostro 3470 Firmware Vostro 3480 Firmware Vostro 3580 Firmware Vostro 3581 Firmware Vostro 3584 Firmware Vostro 3583 Firmware Vostro 3670 Firmware Vostro 5370 Firmware Vostro 5471 Firmware Vostro 5481 Firmware Vostro 5581 Firmware Wyse 7040 Firmware Xps 8900 Firmware Inspiron 7590 Firmware Inspiron 7591 Firmware Vostro 3481 Firmware Vostro 7590 Firmware Xps 13 9380 Firmware Xps 15 9575 Firmware Xps 15 9570 Firmware G3 3590 Firmware Inspiron 14 Gaming 7466 Firmware Inspiron 14 Gaming 7467 Firmware Inspiron 15 7572 Firmware Inspiron 15 Gaming 7566 Firmware Inspiron 15 Gaming 7567 Firmware Inspiron 15 Gaming 7577 Firmware Inspiron 3670 Firmware Inspiron 5488 Firmware Optiplex 3240 Firmware Optiplex 5250 Firmware Optiplex 5260 Firmware Optiplex 7440 Firmware Optiplex 7450 Firmware Optiplex 7460 Firmware Optiplex 7760 Firmware Optiplex 5270 Firmware Optiplex 7470 Firmware Optiplex 7770 Firmware Precision 5720 Firmware Precision 5810 Firmware Precision 7810 Firmware Precision 7910 Firmware Precision 3431 Firmware Vostro 15 7570 Firmware Xps 12 9250 Firmware Xps 13 9343 Firmware Xps 13 9360 Firmware Xps 15 9550 Firmware Xps 15 9560 Firmware Xps 27 7760 Firmware
5.3
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-306
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK

1 technique across 1 tactic: Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS score of 5.3 (MEDIUM). Attack characteristics: physical attack vector, low complexity, no privileges required, no user interaction not required.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to access critical functionality without authentication. No authentication is required to exploit this vulnerability.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Require authentication for all sensitive operations, implement defense in depth.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified as Missing Authentication for Critical Function (CWE-306), which allows attackers to access critical functionality without authentication. Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager. Affected products include: Dell Chengming 3980 Firmware, Dell G3 3579 Firmware, Dell G3 3590 Firmware, Dell G3 3779 Firmware, Dell G5 5587 Firmware.

Know when Latitude 5400 Firmware gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.3 MEDIUM
AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None

DescriptionNVD

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager.

Threat Intelligence Overview

EPSS Score
0.3%
Top 73% exploitable
Data Quality
2 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)NVD

cpe:2.3:o:dell:chengming_3980_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g3_3579_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g3_3590_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g3_3779_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g5_5587_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g5_5590_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_7588_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_7590_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_7790_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:embedded_box_pc_5000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_14_gaming_7466_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_14_gaming_7467_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_15_7572_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_15_gaming_7566_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_15_gaming_7567_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_15_gaming_7577_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3470_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3480_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3481_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3580_firmware:*:*:*:*:*:*:*:*
+ 154 more

More in Latitude 5400 Firmware

View all
CVE-2024-52541 HIGH
8.2 Feb 19

Dell Client Platform BIOS contains a Weak Authentication vulnerability. Rated high severity (CVSS 8.2), this vulnerabili
CVE-2022-32493 HIGH
7.8 Oct 12

Dell BIOS contains an Stack-Based Buffer Overflow vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
CVE-2022-32491 HIGH
7.8 Oct 12

Dell Client BIOS contains a Buffer Overflow vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low att
CVE-2022-32489 HIGH
7.8 Oct 12

Dell BIOS contains an improper input validation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low
CVE-2022-32488 HIGH
7.8 Oct 12

Dell BIOS contains an improper input validation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low
CVE-2022-32487 HIGH
7.8 Oct 12

Dell BIOS contains an improper input validation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low
CVE-2022-32485 HIGH
7.8 Oct 12

Dell BIOS contains an improper input validation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low
CVE-2022-26861 HIGH
7.8 Sep 06

Dell BIOS versions contain an Insecure Automated Optimization vulnerability. Rated high severity (CVSS 7.8), this vulner
CVE-2022-26860 HIGH
7.8 Sep 06

Dell BIOS versions contain a stack-based buffer overflow vulnerability. Rated high severity (CVSS 7.8), this vulnerabili
CVE-2022-26858 HIGH
7.8 Sep 06

Dell BIOS versions contain an Improper Authentication vulnerability. Rated high severity (CVSS 7.8), this vulnerability

CVE-2022-26859 HIGH
7.0 Sep 06

Dell BIOS contains a race condition vulnerability. Rated high severity (CVSS 7.0). No vendor patch available.
CVE-2021-36325 MEDIUM
6.7 Nov 12

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-61757 CRITICAL POC
9.8
CVE-2025-32433 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://www.dell.com/support/article/SLN320337

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy