Improper certificate validation in Dell products - CVE-2021-21571

Vulnerability identifier: #VU54382

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21571

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation within the Dell BIOSConnect and Dell HTTPS Boot features. A remote attacker can perform MitM attack and cause a denial of service or tamper with the system boot.

Inspiron 15 7510
Inspiron 7610
Vostro 15 7510
XPS 13 9305
Inspiron 3891
Vostro 5890
Vostro 3890
Vostro 3690
Latitude 3120
Precision 7560
Precision 7760
Precision 5760
XPS 17 9710
OptiPlex 5090 Tower
OptiPlex 7090 Tower
Precision 3450
OptiPlex 7090 UFF
Precision 3650 MT
OptiPlex 3090 UFF
Latitude 5521
Precision 3561
Latitude 5421
OptiPlex 7490 All-in-One
Inspiron 7500 2n1 - Black
Inspiron 7300 2n1
OptiPlex 5490 AIO
Inspiron 7500 2n1 - Silver
XPS 15 9510
Precision 5560
Alienware m15 R6
Dell G15 5511
Latitude 7320 Detachable
Inspiron 5400 AIO
Inspiron 5401 AIO
Inspiron 7700 AIO
OptiPlex 5080
OptiPlex 7080
Precision 3440
Dell G15 5510
Latitude 3320
Vostro 5880
Inspiron 3881
Inspiron 3880
Latitude 9420
ChengMing 3990
ChengMing 3991
Vostro 5502
Inspiron 5409
Inspiron 5402
Inspiron 5406 2n1
Inspiron 5502
Vostro 5402
Inspiron 5509
Inspiron 7706 2n1
Inspiron 7306 2n1
Inspiron 7506 2n1
Latitude 9520
Vostro 3501
Latitude 5410
Latitude 5411
Latitude 5510
Latitude 5511
Latitude 9510
Precision 3550
Precision 3551
Inspiron 3501
Vostro 3400
Vostro 3500
Precision 3640
OptiPlex 7780 All-in-One
OptiPlex 7480 All-in-One
OptiPlex 3280 All-in-One
Latitude 9410
Latitude 7410
Latitude 7310
Latitude 7210 2-in-1
Inspiron 5400 2n1
Latitude 5310 2 in 1
Latitude 5310
Latitude 5520
Vostro 5300
Inspiron 5300
Latitude 7420
Latitude 7520
Precision 3560
Latitude 7320
Latitude 5320
Latitude 5320 2-in-1
Inspiron 5408
Vostro 5501
Vostro 5401
Inspiron 5401
Inspiron 5501
Inspiron 5508
Vostro 7500
Latitude 3420
Latitude 5420
Latitude 3520
Inspiron 7501
Precision 7750
Inspiron 7500
Precision 7550
Inspiron 7300
XPS 15 9500
Vostro 5301
Inspiron 5301
Precision 5550
Inspiron 7400
XPS 17 9700
Precision 17 M5750
Dell G3 3500
Latitude 3410
Dell G7 7700
Latitude 3510
Dell G5 5500
Dell G7 7500
Vostro 15 5510
Vostro 14 5410
Inspiron 15 5518
Inspiron 14 5418
Inspiron 5410 2-in-1
Inspiron 5310
Vostro 5310
OptiPlex 3080
XPS 13 2in1 9310
Vostro 3881
Vostro 3888
Vostro 3681
XPS 13 9310
Avamar Data Store Gen5A

Install updates from vendor's website.

Inspiron 15 7510 - update to 1.0.4
Inspiron 7610 - update to 1.0.4
Vostro 15 7510 - update to 1.0.4
XPS 13 9305 - update to 1.0.8
Inspiron 3891 - update to 1.0.11
Vostro 5890 - update to 1.0.11
Vostro 3890 - update to 1.0.11
Vostro 3690 - update to 1.0.11
Latitude 3120 - update to 1.1.0
Precision 7560 - update to 1.1.2
Precision 7760 - update to 1.1.2
Precision 5760 - update to 1.1.3
XPS 17 9710 - update to 1.1.3
OptiPlex 5090 Tower - update to 1.1.35
OptiPlex 7090 Tower - update to 1.1.35
Precision 3450 - update to 1.1.35
OptiPlex 7090 UFF - update to 1.2.0
Precision 3650 MT - update to 1.2.0
OptiPlex 3090 UFF - update to 1.2.0
Latitude 5521 - update to 1.3.0 A03
Precision 3561 - update to 1.3.0 A03
Latitude 5421 - update to 1.3.0 A03
OptiPlex 7490 All-in-One - update to 1.3.0
Inspiron 7500 2n1 - Black - update to 1.3.0
Inspiron 7300 2n1 - update to 1.3.0
OptiPlex 5490 AIO - update to 1.3.0
Inspiron 7500 2n1 - Silver - update to 1.3.0
XPS 15 9510 - update to 1.3.2
Precision 5560 - update to 1.3.2
Alienware m15 R6 - update to 1.3.3
Dell G15 5511 - update to 1.3.3
Latitude 7320 Detachable - update to 1.4.0 A04
Inspiron 5400 AIO - update to 1.4.0
Inspiron 5401 AIO - update to 1.4.0
Inspiron 7700 AIO - update to 1.4.0
OptiPlex 5080 - update to 1.4.0
OptiPlex 7080 - update to 1.4.0
Precision 3440 - update to 1.4.0
Dell G15 5510 - update to 1.4.0
Latitude 3320 - update to 1.4.0
Vostro 5880 - update to 1.4.0
Inspiron 3881 - update to 1.4.1
Inspiron 3880 - update to 1.4.1
Latitude 9420 - update to 1.4.1
ChengMing 3990 - update to 1.4.1
ChengMing 3991 - update to 1.4.1
Vostro 5502 - update to 1.5.1
Inspiron 5409 - update to 1.5.1
Inspiron 5402 - update to 1.5.1
Inspiron 5406 2n1 - update to 1.5.1
Inspiron 5502 - update to 1.5.1
Vostro 5402 - update to 1.5.1
Inspiron 5509 - update to 1.5.1
Inspiron 7706 2n1 - update to 1.5.1
Inspiron 7306 2n1 - update to 1.5.1
Inspiron 7506 2n1 - update to 1.5.1
Latitude 9520 - update to 1.5.2
Vostro 3501 - update to 1.6.0
Latitude 5410 - update to 1.6.0
Latitude 5411 - update to 1.6.0
Latitude 5510 - update to 1.6.0
Latitude 5511 - update to 1.6.0
Latitude 9510 - update to 1.6.0
Precision 3550 - update to 1.6.0
Precision 3551 - update to 1.6.0
Inspiron 3501 - update to 1.6.0
Vostro 3400 - update to 1.6.0
Vostro 3500 - update to 1.6.0
Precision 3640 - update to 1.6.2
OptiPlex 7780 All-in-One - update to 1.7.0
OptiPlex 7480 All-in-One - update to 1.7.0
OptiPlex 3280 All-in-One - update to 1.7.0
Latitude 9410 - update to 1.7.0
Latitude 7410 - update to 1.7.0
Latitude 7310 - update to 1.7.0
Latitude 7210 2-in-1 - update to 1.7.0
Inspiron 5400 2n1 - update to 1.7.0
Latitude 5310 2 in 1 - update to 1.7.0
Latitude 5310 - update to 1.7.0
Latitude 5520 - update to 1.7.1
Vostro 5300 - update to 1.7.1
Inspiron 5300 - update to 1.7.1
Latitude 7420 - update to 1.7.1
Latitude 7520 - update to 1.7.1
Precision 3560 - update to 1.7.1
Latitude 7320 - update to 1.7.1
Latitude 5320 - update to 1.7.1
Latitude 5320 2-in-1 - update to 1.7.1
Inspiron 5408 - update to 1.7.2
Vostro 5501 - update to 1.7.2
Vostro 5401 - update to 1.7.2
Inspiron 5401 - update to 1.7.2
Inspiron 5501 - update to 1.7.2
Inspiron 5508 - update to 1.7.2
Vostro 7500 - update to 1.8.0
Latitude 3420 - update to 1.8.0
Latitude 5420 - update to 1.8.0
Latitude 3520 - update to 1.8.0
Inspiron 7501 - update to 1.8.0
Precision 7750 - update to 1.8.0
Inspiron 7500 - update to 1.8.0
Precision 7550 - update to 1.8.0
Inspiron 7300 - update to 1.8.1
XPS 15 9500 - update to 1.8.1
Vostro 5301 - update to 1.8.1
Inspiron 5301 - update to 1.8.1
Precision 5550 - update to 1.8.1
Inspiron 7400 - update to 1.8.1
XPS 17 9700 - update to 1.8.2
Precision 17 M5750 - update to 1.8.2
Dell G3 3500 - update to 1.9.0
Latitude 3410 - update to 1.9.0
Dell G7 7700 - update to 1.9.0
Latitude 3510 - update to 1.9.0
Dell G5 5500 - update to 1.9.0
Dell G7 7500 - update to 1.9.0
Vostro 15 5510 - update to 2.1.0 A06
Vostro 14 5410 - update to 2.1.0 A06
Inspiron 15 5518 - update to 2.1.0 A06
Inspiron 14 5418 - update to 2.1.0 A06
Inspiron 5410 2-in-1 - update to 2.1.0
Inspiron 5310 - update to 2.1.0
Vostro 5310 - update to 2.1.0
OptiPlex 3080 - update to 2.1.1
XPS 13 2in1 9310 - update to 2.3.3
Vostro 3881 - update to 2.4.0
Vostro 3888 - update to 2.4.0
Vostro 3681 - update to 2.4.0
XPS 13 9310 - update to 3.0.0

• https://www.dell.com/support/kbdoc/en-us/000188682

• Multiple vulnerabilities in Dell BIOSConnect and HTTPS Boot features
• Multiple vulnerabilities in Dell Avamar Data Store Gen5A