CVE-2021-36284 : Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated mal

Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive admin password attempt mitigations in order to carry out a brute force attack.

Published 2021-09-28 20:15:08

Updated 2021-10-04 14:25:25

Source Dell

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-36284

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-36284

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.4	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	0.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L	1.5	3.7	Dell
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Changed Confidentiality: Low Integrity: Low Availability: Low

CWE ids for CVE-2021-36284

CWE-307 Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

Assigned by: security_alert@emc.com (Primary)

Products affected by CVE-2021-36284

Dell » Latitude 7280 Firmware
Versions before (<) 1.9.1
cpe:2.3:o:dell:latitude_7280_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 7280 » Version: N/A
Dell » Latitude 7370 Firmware
Versions before (<) 1.7.1
cpe:2.3:o:dell:latitude_7370_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 7370 » Version: N/A
Dell » Latitude 7480 Firmware
Versions before (<) 1.7.1
cpe:2.3:o:dell:latitude_7480_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 7480 » Version: N/A
Dell » Latitude 5400 Firmware
Versions before (<) 1.7.1
cpe:2.3:o:dell:latitude_5400_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 5400 » Version: N/A
Dell » Latitude 5500 Firmware
Versions before (<) 1.8.0
cpe:2.3:o:dell:latitude_5500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 5500 » Version: N/A
Dell » Latitude 5411 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:latitude_5411_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 5411 » Version: N/A
Dell » Latitude 5511 Firmware
Versions before (<) 1.7.1
cpe:2.3:o:dell:latitude_5511_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 5511 » Version: N/A
Dell » Latitude 7212 Rugged Extreme Tablet Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:latitude_7212_rugged_extreme_tablet_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 7212 Rugged Extreme Tablet » Version: N/A
Dell » Latitude 9410 Firmware
Versions before (<) 1.7.1
cpe:2.3:o:dell:latitude_9410_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 9410 » Version: N/A
Dell » Latitude 9510 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:latitude_9510_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 9510 » Version: N/A
Dell » Optiplex 3280 Aio Firmware
Versions before (<) 1.2.0
cpe:2.3:o:dell:optiplex_3280_aio_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Optiplex 3280 Aio » Version: N/A
Dell » Optiplex 7480 Aio Firmware
Versions before (<) 1.2.0
cpe:2.3:o:dell:optiplex_7480_aio_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Optiplex 7480 Aio » Version: N/A
Dell » Precision 3640 Tower Firmware
Versions before (<) 1.7.1
cpe:2.3:o:dell:precision_3640_tower_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Precision 3640 Tower » Version: N/A
Dell » Latitude 5310 2-in-1 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:latitude_5310_2-in-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 5310 2-in-1 » Version: N/A
Dell » Latitude 5320 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:latitude_5320_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 5320 » Version: N/A
Dell » Latitude 5520 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:latitude_5520_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 5520 » Version: N/A
Dell » Latitude 7320 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:latitude_7320_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 7320 » Version: N/A
Dell » Latitude 7420 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:latitude_7420_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 7420 » Version: N/A
Dell » Latitude 9520 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:latitude_9520_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 9520 » Version: N/A
Dell » Optiplex 3080 Firmware
Versions before (<) 1.5.2
cpe:2.3:o:dell:optiplex_3080_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Optiplex 3080 » Version: N/A
Dell » Precision 3551 Ffirmware
Versions before (<) 1.6.2
cpe:2.3:o:dell:precision_3551_ffirmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Precision 3551 » Version: N/A

Vulnerability Details : CVE-2021-36284

Exploit prediction scoring system (EPSS) score for CVE-2021-36284

CVSS scores for CVE-2021-36284

CWE ids for CVE-2021-36284

References for CVE-2021-36284

Products affected by CVE-2021-36284