CVE-2021-21572

2021-06-2417:00:16

CWE-122

dell

www.cve.org

dell

biosconnect

buffer overflow

arbitrary code

uefi restrictions

CVSS3

7.2

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.

CNA Affected

[
  {
    "product": "BIOSConnect",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "Gen 11, Gen 10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]