PT-2020-18401 · Dell · Dell Firmware Update Utility

Eran Shimony · Published 2020-02-21 · Updated 2021-09-14 · CVE-2020-5324

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Client Consumer and Commercial Platforms (affected versions not specified)

Description The issue allows a locally authenticated low-privileged malicious user to exploit the Dell Firmware Update Utility by tricking an administrator into overwriting arbitrary files via a symlink attack. This can happen during the time window when the utility is being executed by an administrator. The actual binary payload delivered by the update utility is not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Uncontrolled Search Path Element

Weakness Enumeration

CWE-59

CWE-427

Related Identifiers

CVE-2020-5324

Affected Products

Dell Firmware Update Utility

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-5324 · Security Note
• https://dell.com/support/article/SLN320348 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5324 · Vendor Advisory