CVE-2021-21574
HIGHCVSS 7.5/10EPSS 0.29%
Last modified
CVE-2021-21574 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.
Metrics
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dell | Alienware M15 R6 Firmware | < 1.3.3 |
| Dell | Chengming 3990 Firmware | < 1.4.1 |
| Dell | Chengming 3991 Firmware | < 1.4.1 |
| Dell | G15 5510 Firmware | < 1.4.0 |
| Dell | G15 5511 Firmware | < 1.3.3 |
| Dell | G3 3500 Firmware | <= 1.9.0 |
| Dell | G5 5500 Firmware | < 1.9.0 |
| Dell | G7 7500 Firmware | < 1.9.0 |
| Dell | G7 7700 Firmware | < 1.9.0 |
| Dell | Inspiron 14 5418 Firmware | < 2.1.0_a06 |
| Dell | Inspiron 15 5518 Firmware | < 2.1.0_a06 |
| Dell | Inspiron 15 7510 Firmware | < 1.0.4 |
| Dell | Inspiron 3501 Firmware | < 1.6.0 |
| Dell | Inspiron 3880 Firmware | < 1.4.1 |
| Dell | Inspiron 3881 Firmware | < 1.4.1 |
| Dell | Inspiron 3891 Firmware | < 1.0.11 |
| Dell | Inspiron 5300 Firmware | < 1.7.1 |
| Dell | Inspiron 5301 Firmware | < 1.8.1 |
| Dell | Inspiron 5310 Firmware | < 2.1.0 |
| Dell | Inspiron 5400 2-In-1 Firmware | < 1.7.0 |
| Dell | Inspiron 5400 Aio Firmware | < 1.4.0 |
| Dell | Inspiron 5401 Firmware | < 1.7.2 |
| Dell | Inspiron 5401 Aio Firmware | < 1.4.0 |
| Dell | Inspiron 5402 Firmware | < 1.5.1 |
| Dell | Inspiron 5406 2n1 Firmware | < 1.5.1 |
| Dell | Inspiron 5408 Firmware | < 1.7.2 |
| Dell | Inspiron 5409 Firmware | < 1.5.1 |
| Dell | Inspiron 5410 2-In-1 Firmware | < 2.1.0 |
| Dell | Inspiron 5501 Firmware | < 1.7.2 |
| Dell | Inspiron 5502 Firmware | < 1.5.1 |
| Dell | Inspiron 5508 Firmware | < 1.7.2 |
| Dell | Inspiron 5509 Firmware | < 1.5.1 |
| Dell | Inspiron 7300 Firmware | < 1.8.1 |
| Dell | Inspiron 7300 2-In-1 Firmware | < 1.3.0 |
| Dell | Inspiron 7306 2-In-1 Firmware | < 1.5.1 |
| Dell | Inspiron 7400 Firmware | < 1.8.1 |
| Dell | Inspiron 7500 Firmware | < 1.8.0 |
| Dell | Inspiron 7500 2-In-1 Firmware | < 1.3.0 |
| Dell | Inspiron 7501 Firmware | < 1.8.0 |
| Dell | Inspiron 7506 Firmware | < 1.5.1 |
| Dell | Inspiron 7610 Firmware | < 1.0.4 |
| Dell | Inspiron 7700 Aio Firmware | < 1.4.0 |
| Dell | Inspiron 7706 2-In-1 Firmware | < 1.5.1 |
| Dell | Latitude 3120 Firmware | < 1.1.0 |
| Dell | Latitude 3320 Firmware | < 1.4.0 |
| Dell | Latitude 3410 Firmware | < 1.9.0 |
| Dell | Latitude 3420 Firmware | < 1.8.0 |
| Dell | Latitude 3510 Firmware | < 1.9.0 |
| Dell | Latitude 3520 Firmware | < 1.8.0 |
| Dell | Latitude 5310 Firmware | < 1.7.0 |
Showing 50 of 128 affected configurations. See NVD for the full list.
References
- https://www.dell.com/support/kbdoc/en-us/000188682Vendor Advisory
- https://www.dell.com/support/kbdoc/en-us/000188682Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-21574?
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.
How severe is CVE-2021-21574?
CVE-2021-21574 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.29% probability of exploitation in the next 30 days.
How do I fix CVE-2021-21574?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-21569Dell NetWorker, versions 18.x and 19.x contain a Path traver…4.9
- CVE-2021-2157Vulnerability in the Oracle WebLogic Server product of Oracl…7.5
- CVE-2021-21570Dell NetWorker, versions 18.x and 19.x contain an Informatio…4.9
- CVE-2021-21571Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect…6.5
- CVE-2021-21572Dell BIOSConnect feature contains a buffer overflow vulnerab…7.5
- CVE-2021-21573Dell BIOSConnect feature contains a buffer overflow vulnerab…7.5
- CVE-2021-21575 Dell BSAFE Micro Edition Suite, versions before 4.5.2, cont…9.8
- CVE-2021-21576Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-b…6.1
- CVE-2021-21577Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-b…6.1
- CVE-2021-21578Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open…6.1
- CVE-2021-21579Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open…6.1
- CVE-2021-2158Vulnerability in the Hyperion Financial Management product o…3.9
Are you affected by CVE-2021-21574?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST