CVE-2020-5362: Dell Chengming 3967 Auth Bypass Vulnerability

CVE-2020-5362 Overview

CVE-2020-5362 is an improper authorization vulnerability affecting Dell Client Consumer and Commercial platforms. The flaw resides in the Dell Manageability interface and allows an authenticated local attacker with OS administrator privileges to bypass BIOS Administrator authentication. A successful attacker can restore BIOS Setup configuration to default values without supplying the BIOS Administrator credential. The weakness is tracked under CWE-285 (Improper Authorization) and CWE-862 (Missing Authorization). The issue affects a large range of Dell devices spanning Inspiron, Latitude, OptiPlex, Precision, Vostro, XPS, Wyse, and G-series product lines.

Critical Impact
A local administrator can silently reset BIOS Setup configuration to default values, eroding firmware-level security controls such as Secure Boot, boot order restrictions, and pre-boot authentication policies.

Affected Products

Dell Latitude, OptiPlex, Precision, Vostro, and XPS commercial platforms (multiple generations)
Dell Inspiron, G-series, Chengming, and Embedded Box PC consumer platforms
Dell Wyse 5070, 5470, and 7040 thin clients

Discovery Timeline

2020-06-10 - CVE-2020-5362 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-5362

Vulnerability Analysis

The Dell Manageability interface exposes runtime controls used by Dell management tooling to interact with BIOS settings from within the operating system. The interface is intended to honor the BIOS Administrator password as the gating control for sensitive operations such as resetting BIOS Setup configuration. In affected firmware, the authorization check for the "restore to default" operation is missing or incorrectly enforced. An actor running with OS administrator privileges can therefore invoke the operation through the Dell Manageability interface and have the BIOS apply default values without ever validating the BIOS Administrator credential.

Resetting BIOS Setup to defaults weakens the firmware security posture of the device. Settings such as Secure Boot, boot order, USB and external port restrictions, TPM configuration, and pre-boot authentication can revert to permissive defaults. This creates a path toward further compromise, including persistence and physical-access attack scenarios on the next boot.

Root Cause

The root cause is missing authorization in the Manageability interface handler responsible for the "restore BIOS Setup defaults" function. The handler relies on the caller's OS privilege level rather than verifying possession of the BIOS Administrator credential. This conflates OS administrative authority with firmware administrative authority, which are intended to be separate trust boundaries.

Attack Vector

Exploitation requires local access and OS administrator privileges. User interaction is not required. An attacker who has already obtained administrator rights through other means (credential theft, malware execution, or insider access) can invoke the Manageability interface from the OS to issue the reset-to-defaults command. The operation completes without prompting for the BIOS Administrator password, after which the system applies default BIOS Setup values.

No public proof-of-concept code or exploit module has been published for this issue, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2020-5362

Indicators of Compromise

Unexpected reversion of BIOS Setup values, including Secure Boot state, boot order, virtualization, and TPM settings.
Process activity invoking Dell Manageability components or dcc.exe/Dell Command tooling from non-administrative workflows.
BIOS event logs showing a configuration reset event without a corresponding authenticated BIOS Setup session.

Detection Strategies

Monitor endpoint telemetry for execution of Dell management binaries that interact with the BIOS interface, especially when launched by scripts or unmanaged processes.
Compare periodic BIOS configuration snapshots against a known-good baseline to identify unauthorized resets.
Correlate OS-level privilege escalation events with subsequent firmware configuration changes on the same host.

Monitoring Recommendations

Forward BIOS and platform event logs to a centralized SIEM or data lake for cross-host correlation.
Track use of administrative accounts on Dell client endpoints and alert on rare interactions with manageability drivers and WMI providers.
Enroll affected systems in firmware integrity monitoring where supported by the platform.

How to Mitigate CVE-2020-5362

Immediate Actions Required

Apply the BIOS update published by Dell for each affected platform as listed in the Dell security advisory.
Restrict membership of local administrator groups on Dell client endpoints and enforce least privilege.
Re-verify BIOS Setup configuration after patching to confirm that Secure Boot, boot order, and TPM settings reflect the intended baseline.

Patch Information

Dell has released BIOS updates for the affected Client Consumer and Commercial platforms. Refer to the Dell Support Article SLN321726 for the per-model fixed BIOS versions and download links. Updates should be deployed using a managed firmware update workflow such as Dell Command | Update or an equivalent enterprise deployment tool.

Workarounds

Limit OS administrator rights to a small, monitored set of accounts and require just-in-time elevation.
Maintain a documented BIOS baseline and reapply BIOS Administrator passwords and security settings after any suspected reset.
Where supported, disable or restrict the Dell Manageability interface on systems that do not require in-band BIOS configuration changes.

bash

# Example: verify installed BIOS version on Windows before and after patching
wmic bios get smbiosbiosversion,manufacturer,name

# Example: verify BIOS version on Linux
sudo dmidecode -s bios-version