CVE-2021-36285

MEDIUM

Dell Latitude BIOS < 1.9.1 - Authenticated Brute Force Attack via NVMe Password Bypass

Title source: llm
STIX 2.1

Description

Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://www.dell.com/support/kbdoc/000191495/

Scores

CVSS v3 5.7
EPSS 0.0005
EPSS Percentile 15.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Details

CWE
CWE-307
Status published
Products (21)
dell/latitude_5310_2-in-1_firmware < 1.7.0
dell/latitude_5320_firmware < 1.7.0
dell/latitude_5400_firmware < 1.7.1
dell/latitude_5411_firmware < 1.6.0
dell/latitude_5500_firmware < 1.8.0
dell/latitude_5511_firmware < 1.7.1
dell/latitude_5520_firmware < 1.6.0
dell/latitude_7212_rugged_extreme_tablet_firmware < 1.7.0
dell/latitude_7280_firmware < 1.9.1
dell/latitude_7320_firmware < 1.7.0
... and 11 more
Published Sep 28, 2021
Tracked Since Feb 18, 2026