EUVD-2026-41525
GHSA-665g-qf3w-4vf7
Severity by source
AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
Physical access (AV:P) and high complexity (AC:H) confirmed by description; PR:N because bypass defeats authentication itself; I:H reflects BIOS control modification risk beyond mere disclosure.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.
AnalysisAI
Physical-access authentication bypass in Dell Client Platform BIOS (CWE-305) affects a sweeping range of Dell consumer, gaming, and enterprise platforms - including Inspiron, Alienware, Latitude, OptiPlex, and Precision lines. An unauthenticated attacker with physical access and the ability to meet high-complexity attack conditions can bypass the primary BIOS authentication mechanism, resulting in information disclosure and, per the CVSS integrity metric (I:H), potential high-integrity impact. Notably, the declared impact in the description is limited to 'Information Disclosure' while the supplied CVSS vector assigns I:H, a discrepancy that warrants clarification from Dell's advisory DSA-2026-195. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-305 (Authentication Bypass by Primary Weakness) describes a class of flaw in which the root authentication control - in this case, the BIOS firmware authentication mechanism - contains a fundamental weakness exploitable to bypass the check entirely rather than defeat it cryptographically. In BIOS/UEFI firmware contexts this commonly manifests as flaws in BIOS password enforcement, Secure Boot chain-of-trust validation, or pre-boot access controls (e.g., administrator/supervisor password protection). CPE strings identify the affected components as Dell application-layer BIOS entries (cpe:2.3:a:dell:...) spanning the Inspiron 15 3520, G15 5530, Alienware M15 R6/R7, Alienware 16 Area-51 AA16250, Alienware 16 Aurora AC16250, Alienware 16X Aurora AC16251, Alienware 18 Area-51 AA18250, Alienware Area-51 AAT2250, and Alienware Aurora ACT1250 among many others listed in the tags. The AV:P vector string confirms the vulnerability requires physical device access and is not remotely exploitable. AC:H indicates the bypass is not trivial to execute and likely requires specific knowledge of the BIOS weakness, specialized tooling, or exact timing.
RemediationAI
The primary remediation is to apply updated BIOS firmware as released by Dell and detailed in advisory DSA-2026-195 at https://www.dell.com/support/kbdoc/en-us/000452197/dsa-2026-195. Exact fixed firmware version numbers were not provided in the available intelligence; administrators should consult the advisory directly to identify the specific BIOS revision required for each affected platform. Patch availability is confirmed per the vendor advisory reference, but the specific patched version has not been independently verified from the data available. As a compensating control prior to patching, organizations should enforce physical access controls to restrict unauthorized physical access to affected Dell systems - this directly negates AV:P exploitation. Additionally, enabling full-disk encryption (BitLocker or equivalent) limits the value of BIOS-level information disclosure even if the bypass is achieved. BIOS change auditing and chassis intrusion detection should be enabled where supported. Note that these compensating controls do not remediate the underlying authentication bypass flaw and firmware patching remains the definitive fix.
Same weakness CWE-305 – Authentication Bypass by Primary Weakness
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today