EUVD-2025-209501
GHSA-2h3v-69mw-9j56
Severity by source
AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Physical access is the sole vector (AV:P); no prior auth needed to initiate recovery (PR:N); scope change (S:C) reflects BIOS compromise enabling downstream OS-layer impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Dell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability, leading to unauthorized access.
AnalysisAI
Unauthorized BIOS access on Dell Client Platform systems is possible via a weak password recovery mechanism exploitable by anyone with physical access to the device. Affecting over 60 distinct Dell product lines - including Dell Pro, Alienware, ChengMing, and Dell G-series models - the flaw allows a physically-present, unauthenticated attacker to bypass BIOS password protections, with a CVSS-noted scope change indicating that the compromise can extend beyond the firmware layer itself. No public exploit code or CISA KEV listing exists; EPSS stands at 0.01%, and SSVC confirms exploitation status as 'none,' making this a low-urgency but real-risk issue for environments where physical security cannot be guaranteed.
Technical ContextAI
CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) describes a flaw where the process designed to help users regain access to a protected system is itself insufficiently secured. In this case, the vulnerable component is the UEFI/BIOS firmware present on a broad range of Dell client platforms. The BIOS password is a pre-boot access control that protects system configuration, boot order, secure boot settings, and hardware-level security features. A weak recovery path - such as a predictable challenge-response scheme, a static master password algorithm, or an insufficiently validated recovery token - allows an attacker who physically interacts with the system at boot time to circumvent this control entirely. CPE data confirms the vulnerability spans Dell's consumer and commercial product portfolios, from the Dell Pro Essential and Premium lines to Alienware gaming desktops and laptops, and the ChengMing commercial desktop line. The S:C (scope changed) attribute in the CVSS vector reflects that a successful BIOS compromise can affect the integrity and security of software components running above the firmware layer, such as the bootloader and operating system.
RemediationAI
The primary remediation is to apply the BIOS update for each affected platform to the minimum fixed version documented in Dell advisory DSA-2025-153 (https://www.dell.com/support/kbdoc/en-us/000300450/dsa-2025-153). Each affected model has a distinct minimum-fixed BIOS version (e.g., Dell Pro Laptop PC14250 requires 1.10.2 or later; Alienware 16X Aurora AC16251 requires 1.8.1 or later; Alienware m15 R6 requires 1.42.0 or later). Administrators should consult the advisory for the exact fix version per model and deploy BIOS updates through Dell Command Update, Dell Update, or WSUS-integrated Dell update tools for enterprise fleets. As a compensating control where immediate BIOS updates are not feasible, restrict physical access to affected systems through physical security measures such as device locking, locked cabinets, or controlled-access facilities - this directly eliminates the AV:P attack surface. Additionally, for managed enterprise environments, enabling BitLocker or equivalent full-disk encryption at the OS level limits the practical impact of a BIOS password bypass, since compromising BIOS settings alone does not grant access to encrypted data. Note that physical security controls are operationally burdensome and do not address the underlying firmware defect; patching remains the authoritative fix.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today