Back to the CVE list
CVE-2021-36324

Improper input validation in Dell CPG BIOS

CVSS score

7.5

EPSS probability

%0.2

Risk score

0.0

Published

5 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Patch status has not yet been verified

Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2021-36324 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2021-36324 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1dellCPG BIOS View
2dellalienware 13 r3 firmware View
3dellalienware 13 r3 View
4dellalienware 15 r3 firmware View
5dellalienware 15 r3 View
6dellalienware 15 r4 firmware View
7dellalienware 15 r4 View
8dellalienware 17 r4 firmware View
9dellalienware 17 r4 View
10dellalienware 17 r5 firmware View
11dellalienware 17 r5 View
12dellalienware area 51m r1 firmware View
13dellalienware area 51m r1 View
14dellalienware area 51m r2 firmware View
15dellAlienware Area 51m R2 View
16dellalienware aurora r11 firmware View
17dellalienware aurora r11 View
18dellalienware aurora r12 firmware View
19dellalienware aurora r12 View
20dellalienware aurora r7 firmware View
21dellalienware aurora r7 View
22dellalienware aurora r8 firmware View
23dellalienware aurora r8 View
24dellalienware aurora r9 firmware View
25dellalienware aurora r9 View
26dellalienware aurora ryzen edition firmware View
27dellalienware aurora ryzen edition View
28dellalienware m15 r1 firmware View
29dellalienware m15 r1 View
30dellalienware m15 r2 firmware View
31dellalienware m15 r2 View
32dellalienware m15 r3 firmware View
33dellAlienware m15 R3 View
34dellalienware m17 r1 firmware View
35dellalienware m17 r1 View
36dellalienware m17 r2 firmware View
37dellalienware m17 r2 View
38dellalienware m17 r3 firmware View
39dellAlienware m17 R3 View
40dellalienware x15 r1 firmware View
41dellAlienware x15 R1 View
42dellalienware x17 r1 firmware View
43dellAlienware x17 R1 View
44dellchengming 3977 firmware View
45dellchengming 3977 View
46dellchengming 3980 firmware View
47dellchengming 3980 View
48dellchengming 3988 firmware View
49dellchengming 3988 View
50dellchengming 3990 firmware View
51dellchengming 3990 View
52dellchengming 3991 firmware View
53dellchengming 3991 View
54dellg3 3579 firmware View
55dellg3 3579 View
56dellg3 3590 firmware View
57dellg3 3590 View
58dellg3 3779 firmware View
59dellg3 3779 View
60dellg5 5000 firmware View
61dellg5 5000 View
62dellg5 5090 firmware View
63dellg5 5090 View
64dellg5 5587 firmware View
65dellg5 5587 View
66dellg5 5590 firmware View
67dellg5 5590 View
68dellg7 7587 firmware View
69dellg7 7587 View
70dellg7 7588 firmware View
71dellg7 7588 View
72dellg7 7590 firmware View
73dellg7 7590 View
74dellg7 7790 firmware View
75dellg7 7790 View
76dellembedded box pc 5000 firmware View
77dellembedded box pc 5000 View
78dellinspiron 13 5378 firmware View
79dellinspiron 13 5378 View
80dellinspiron 13 5379 firmware View
81dellinspiron 13 5379 View
82dellinspiron 14 3467 firmware View
83dellinspiron 14 3467 View
84dellinspiron 14 5468 firmware View
85dellinspiron 14 5468 View
86dellinspiron 15 3567 firmware View
87dellinspiron 15 3567 View
88dellinspiron 15 5566 firmware View
89dellinspiron 15 5566 View
90dellinspiron 15 5578 firmware View
91dellinspiron 15 5578 View
92dellinspiron 15 5579 firmware View
93dellinspiron 15 5579 View
94dellinspiron 15 5582 firmware View
95dellinspiron 15 5582 View
96dellinspiron 15 7570 firmware View
97dellinspiron 15 7570 View
98dellinspiron 15 7572 firmware View
99dellinspiron 15 7572 View
100dellinspiron 15 7573 firmware View
101dellinspiron 15 7573 View
102dellinspiron 15 7577 firmware View
103dellinspiron 15 7577 View
104dellinspiron 17 7773 firmware View
105dellinspiron 17 7773 View
106dellinspiron 3268 firmware View
107dellinspiron 3268 View
108dellinspiron 3277 firmware View
109dellinspiron 3277 View
110dellinspiron 3280 firmware View
111dellinspiron 3280 View
112dellinspiron 3470 firmware View
113dellinspiron 3470 View
114dellinspiron 3471 firmware View
115dellinspiron 3471 View
116dellinspiron 3476 firmware View
117dellinspiron 3476 View
118dellinspiron 3477 firmware View
119dellinspiron 3477 View
120dellinspiron 3480 firmware View
121dellinspiron 3480 View
122dellinspiron 3480 firmware View
123dellinspiron 3481 firmware View
124dellinspiron 3481 View
125dellinspiron 3576 firmware View
126dellinspiron 3576 View
127dellinspiron 3580 firmware View
128dellinspiron 3580 View
129dellinspiron 3581 firmware View
130dellinspiron 3581 View
131dellinspiron 3668 firmware View
132dellinspiron 3668 View
133dellinspiron 3670 firmware View
134dellinspiron 3670 View
135dellinspiron 3671 firmware View
136dellinspiron 3671 View
137dellinspiron 3780 firmware View
138dellinspiron 3780 View
139dellinspiron 3781 firmware View
140dellinspiron 3781 View
141dellinspiron 3880 firmware View
142dellinspiron 3880 View
143dellinspiron 3881 firmware View
144dellinspiron 3881 View
145dellinspiron 5370 firmware View
146dellinspiron 5370 View
147dellinspiron 5400 firmware View
148dellinspiron 5400 View
149dellinspiron 5401 firmware View
150dellinspiron 5401 View
151dellinspiron 5477 firmware View
152dellinspiron 5477 View
153dellinspiron 5480 firmware View
154dellinspiron 5480 View
155dellinspiron 5481 firmware View
156dellinspiron 5481 View
157dellinspiron 5482 firmware View
158dellinspiron 5482 View
159dellinspiron 5490 firmware View
160dellinspiron 5490 View
161dellinspiron 5570 firmware View
162dellinspiron 5570 View
163dellinspiron 5580 firmware View
164dellinspiron 5580 View
165dellinspiron 5680 firmware View
166dellinspiron 5680 View
167dellinspiron 5770 firmware View
168dellinspiron 5770 View
169dellinspiron 7370 firmware View
170dellinspiron 7370 View
171dellinspiron 7373 firmware View
172dellinspiron 7373 View
173dellinspiron 7380 firmware View
174dellinspiron 7380 View
175dellinspiron 7386 firmware View
176dellinspiron 7386 View
177dellinspiron 7467 firmware View
178dellinspiron 7467 View
179dellinspiron 7472 firmware View
180dellinspiron 7472 View
181dellinspiron 7567 firmware View
182dellinspiron 7567 View
183dellinspiron 7580 firmware View
184dellinspiron 7580 View
185dellinspiron 7586 firmware View
186dellinspiron 7586 View
187dellinspiron 7590 firmware View
188dellinspiron 7590 View
189dellinspiron 7591 firmware View
190dellinspiron 7591 View
191dellinspiron 7700 firmware View
192dellinspiron 7700 View
193dellinspiron 7777 firmware View
194dellinspiron 7777 View
195dellinspiron 7786 firmware View
196dellinspiron 7786 View
197dellinspiron 7790 firmware View
198dellinspiron 7790 View
199dellinspiron 5491 firmware View
200dellinspiron 5491 View
Total affected vendors: 1|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
7.5CVSS V31HIGHCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HNVD
7.5CVSS V3_1HIGHCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HCVE CNA
7.2CVSS V2—AV:L/AC:L/Au:N/C:C/I:C/A:CNVD
6.7CVSS V31MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch status unknown

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Until a patch is confirmed, follow the vendor advisory; do not read an unknown status as “no patch”.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-36324 is associated with the following CWEs:

CWE-20: Improper Input Validation

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-36324 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureYerel erişim
PermissionsHigh
UserGerekmiyor

Official Sources and Advisories

https://www.dell.com/support/kbdoc/en-us/000192967vendor-advisory

CVSS Vector Radar Chart

7.5 / 10
Attack VectorLocalComplexityHighPrivilegesHighUser Interact.NoneConfidentialityHighIntegrityNoneAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack VectorLocal
Attack ComplexityHigh
Privileges RequiredHigh privileges
User InteractionNone required
Confidentiality (Gizlilik)High
Integrity (Bütünlük)None
Availability (Erişilebilirlik)High

Yama durumu bilinmiyor

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Follow the vendor

D
dell logo
dell

Weakness Type (CWE & CAPEC)

CWE-20

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2021-36324"