Dell Client Consumer/Commercial Platform Management Interface null byte or nul character

Summaryinfo

A vulnerability classified as critical has been found in Dell Client Consumer and Commercial Platform. Affected by this vulnerability is an unknown functionality of the component Management Interface. Performing a manipulation results in improper neutralization of null byte or nul character. This vulnerability is cataloged as CVE-2020-5363. The attack may be carried out on the physical device. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in Dell Client Consumer and Commercial Platform (version now known). This affects some unknown processing of the component Management Interface. The manipulation with an unknown input leads to a improper neutralization of null byte or nul character vulnerability. CWE is classifying the issue as CWE-158. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.

The weakness was shared 06/10/2020. This vulnerability is uniquely identified as CVE-2020-5363 since 01/03/2020. Attacking locally is a requirement. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-156518 is related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Dell

Name

• Client Consumer
• Commercial Platform

License

• commercial

Website

• Vendor: https://www.dell.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion