Dell Client Platform BIOS CVE-2026-40639

Physical access to the target device is the absolute prerequisite - the CVSS vector AV:P confirms exploitation cannot occur remotely or over a network. The high attack complexity (AC:H) indicates the attacker must employ non-trivial hardware techniques to read BIOS flash storage, such as SPI clip-on programming, debug interface access, or chip removal; simply pressing keys at boot is insufficient. No authentication is required prior to physical access (PR:N). The vulnerability affects BIOS firmware versions below the per-platform fixed thresholds; systems already running patched firmware versions are not affected. Exploitation is limited by: the requirement for hands-on device access, the hardware skill and equipment needed to read BIOS flash, and the scope being limited to BIOS-level privilege escalation rather than direct OS or network compromise. There is no indication that default BIOS configurations exclude any specific option - the weak encoding applies to any stored BIOS password on vulnerable firmware versions.

The CVSS 3.1 base score of 5.7 reflects the constrained real-world exploitability: AV:P (physical access to the device required) and AC:H (high attack complexity, indicating non-trivial technique or specific conditions) together represent a substantially restricted attack surface compared to network-exploitable vulnerabilities. PR:N confirms no prior authentication is required, but that is only meaningful once physical access is achieved. The confidentiality and integrity impacts are both rated High, meaning successful exploitation fully compromises BIOS credential confidentiality and allows full write access to BIOS configuration - a serious post-physical outcome. No EPSS data was provided; it would be expected to be low given the physical prerequisite. The vulnerability is not listed in the CISA KEV catalog and no POC has been identified, further confirming no widespread opportunistic exploitation. Risk is most elevated for ruggedized/field-deployed Latitude units (common in logistics, utilities, defense) and Edge Gateway deployments in unmanned infrastructure - environments where physical security posture may be weaker. Enterprise deployments with robust physical access controls face materially lower risk. CVSS score and impact metrics are consistent with description; no conflicting signals detected.

An attacker with unsupervised physical access to an unpatched Dell Edge Gateway or Latitude Rugged device - for example, a contractor visiting an unmanned industrial site - connects a hardware SPI flash programmer via a clip to the board's BIOS chip, reads the firmware image, and uses offline tooling to locate and decode the weakly-encoded BIOS supervisor password from the NVRAM region. With the recovered password, the attacker reboots the device, enters BIOS setup, disables Secure Boot or modifies the boot order to load a malicious OS or pre-boot agent, achieving persistent elevated access beyond the operating system. No public POC has been identified, but the technique is well-understood within hardware security research.