CVE-2020-5324

21.02.2020, 15:15

Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utility during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers.

Link Following

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.1 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
dell	CNA	7.1 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 28%

Vendor	Product	Version
dell	g3_3579_firmware	𝑥 < 1.11.0
dell	g3_3779_firmware	𝑥 < 1.11.0
dell	g3_15_3590_firmware	𝑥 < 1.9.2
dell	g5_15_5590_firmware	𝑥 < 1.11.1
dell	g5_5090_firmware	𝑥 < 1.1.2
dell	g5_5587_firmware	𝑥 < 1.12.2
dell	g7_15_7590_firmware	𝑥 < 1.11.1
dell	g7_17_7790_firmware	𝑥 < 1.11.1
dell	g7_7588_firmware	𝑥 < 1.12.2
dell	inspiron_14_5490_firmware	𝑥 < 1.4.0
dell	inspiron_3480_firmware	𝑥 < 1.7.0
dell	inspiron_3481_firmware	𝑥 < 1.6.0
dell	inspiron_3490_firmware	𝑥 < 1.5.0
dell	inspiron_3493_firmware	𝑥 < 1.4.0
dell	inspiron_3580_firmware	𝑥 < 1.7.0
dell	inspiron_3581_firmware	𝑥 < 1.6.0
dell	inspiron_3583_firmware	𝑥 < 1.7.0
dell	inspiron_3584_firmware	𝑥 < 1.6.0
dell	inspiron_3590_firmware	𝑥 < 1.5.0
dell	inspiron_3593_firmware	𝑥 < 1.4.0
dell	inspiron_3780_firmware	𝑥 < 1.7.0
dell	inspiron_3781_firmware	𝑥 < 1.6.0
dell	inspiron_3790_firmware	𝑥 < 1.5.0
dell	inspiron_3793_firmware	𝑥 < 1.4.0
dell	inspiron_5390_firmware	𝑥 < 1.7.1
dell	inspiron_5391_firmware	𝑥 < 1.3.0
dell	inspiron_5480_firmware	𝑥 < 2.6.1
dell	inspiron_5481_firmware	𝑥 < 2.6.1
dell	inspiron_5482_firmware	𝑥 ≤ 2.6.1
dell	inspiron_5491_firmware	𝑥 < 1.4.0
dell	inspiron_5493_firmware	𝑥 < 1.4.0
dell	inspiron_5494_firmware	𝑥 < 1.5.0
dell	inspiron_5498_firmware	𝑥 < 1.4.0
dell	inspiron_5580_firmware	𝑥 < 2.6.1
dell	inspiron_5582_firmware	𝑥 < 2.6.1
dell	inspiron_5583_firmware	𝑥 < 1.9.1
dell	inspiron_5584_firmware	𝑥 < 1.9.1
dell	inspiron_5590_firmware	𝑥 < 1.4.0
dell	inspiron_5591_firmware	𝑥 < 1.4.0
dell	inspiron_5593_firmware	𝑥 < 1.4.0
dell	inspiron_5594_firmware	𝑥 < 1.5.0
dell	inspiron_5598_firmware	𝑥 < 1.4.0
dell	inspiron_7380_firmware	𝑥 < 1.10.0
dell	inspiron_7386_firmware	𝑥 < 1.7.0
dell	inspiron_7390_firmware	𝑥 < 1.7.1
dell	inspiron_7391_firmware	𝑥 < 1.3.0
dell	inspiron_7490_firmware	𝑥 < 1.2.1
dell	inspiron_7580_firmware	𝑥 < 1.10.0
dell	inspiron_7586_firmware	𝑥 < 1.7.0
dell	inspiron_7590_firmware	𝑥 < 1.5.1
dell	inspiron_7591_firmware	𝑥 < 1.5.1
dell	inspiron_7786_firmware	𝑥 < 1.7.0
dell	inspiron_7791_firmware	𝑥 < 1.3.1
dell	latitude_3301_firmware	𝑥 < 1.7.0
dell	latitude_3300_firmware	𝑥 < 1.7.2
dell	latitude_3311_firmware	𝑥 < 1.3.0
dell	latitude_3390_firmware	𝑥 < 1.12.0
dell	latitude_3400_firmware	𝑥 < 1.9.2
dell	latitude_3490_firmware	𝑥 < 1.11.0
dell	latitude_3500_firmware	𝑥 < 1.9.2
dell	latitude_3590_firmware	𝑥 < 1.11.0
dell	latitude_5290_firmware	𝑥 < 1.12.1
dell	latitude_5300_firmware	𝑥 < 1.7.2
dell	latitude_5400_firmware	𝑥 < 1.6.3
dell	latitude_5401_firmware	𝑥 < 1.6.1
dell	latitude_5420_rugged_firmware	𝑥 < 1.8.5
dell	latitude_5424_rugged_firmware	𝑥 < 1.8.5
dell	latitude_5490_firmware	𝑥 < 1.12.1
dell	latitude_5491_firmware	𝑥 < 1.11.1
dell	latitude_5500_firmware	𝑥 < 1.6.3
dell	latitude_5501_firmware	𝑥 < 1.6.1
dell	latitude_5590_firmware	𝑥 < 1.12.1
dell	latitude_5591_firmware	𝑥 < 1.11.1
dell	latitude_7200_firmware	𝑥 < 1.6.2
dell	latitude_7220_rugged_extreme_tablet_firmware	𝑥 < 1.3.1
dell	latitude_7220ex_rugged_extreme_tablet_firmware	𝑥 < 1.3.1
dell	latitude_7290_firmware	𝑥 < 1.13.1
dell	latitude_7300_firmware	𝑥 < 1.6.1
dell	latitude_7390_firmware	𝑥 < 1.13.1
dell	latitude_7400_firmware	𝑥 < 1.6.1
dell	latitude_7424_rugged_extreme_firmware	𝑥 < 1.8.5
dell	latitude_7490_firmware	𝑥 < 1.13.1
dell	precision_3530_firmware	𝑥 < 1.11.1
dell	precision_3540_firmware	𝑥 < 1.6.3
dell	precision_3541_firmware	𝑥 < 1.6.1
dell	precision_5530_firmware	𝑥 < 1.14.0
dell	precision_5540_firmware	𝑥 < 1.6.3
dell	precision_7530_firmware	𝑥 < 1.12.1
dell	precision_7540_firmware	𝑥 < 1.5.1
dell	precision_7730_firmware	𝑥 < 1.12.1
dell	precision_7740_firmware	𝑥 < 1.5.1
dell	vostro_15_7580_firmware	𝑥 < 1.12.2
dell	vostro_3480_firmware	𝑥 < 1.7.0
dell	vostro_3481_firmware	𝑥 < 1.6.0
dell	vostro_3490_firmware	𝑥 < 1.5.0
dell	vostro_3580_firmware	𝑥 < 1.7.0
dell	vostro_3581_firmware	𝑥 < 1.6.0
dell	vostro_3583_firmware	𝑥 < 1.7.0
dell	vostro_3584_firmware	𝑥 < 1.6.0
dell	vostro_3590_firmware	𝑥 < 1.5.0
dell	vostro_5390_firmware	𝑥 < 1.7.1
dell	vostro_5391_firmware	𝑥 < 1.3.0
dell	vostro_5481_firmware	𝑥 < 2.6.1
dell	vostro_5490_firmware	𝑥 < 1.4.0
dell	vostro_5581_firmware	𝑥 < 2.6.1
dell	vostro_5590_firmware	𝑥 < 1.4.0
dell	vostro_7590_firmware	𝑥 < 1.5.1
dell	wyse_5070_thin_client_firmware	𝑥 < 1.4.2
dell	wyse_5470_firmware	𝑥 < 1.2.1
dell	xps_13_9380_firmware	𝑥 < 1.9.1
dell	xps_15_9575_firmware	𝑥 < 1.10.0
dell	xps_15_7590_firmware	𝑥 < 1.4.0
dell	xps_15_9570_firmware	𝑥 < 1.14.0

𝑥

= Vulnerable software versions

Common Weakness Enumeration

References

https://www.dell.com/support/article/SLN320348