How severe is CVE-2020-5326?

CVE-2020-5326 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability high.

Is CVE-2020-5326 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-5326?

CVE-2020-5326 primarily affects Dell Chengming 3980 Firmware. In total, 174 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-5326?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-5326 published?

CVE-2020-5326 was published on 2020-02-21 and last updated on 2026-06-17.

CVE-2020-5326

CVE-2020-5326 is a medium-severity vulnerability in Dell Chengming 3980 Firmware with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-306.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
CVSS v2: 2.1
EPSS exploit prediction: 0% (27th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-306
Affected product: Dell Chengming 3980 Firmware
Published: 2020-02-21
Last modified: 2026-06-17

Description

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager.

Frequently asked questions

What is CVE-2020-5326?: Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager.
How severe is CVE-2020-5326?: CVE-2020-5326 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability high.
Is CVE-2020-5326 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-5326?: CVE-2020-5326 primarily affects Dell Chengming 3980 Firmware. In total, 174 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-5326?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-5326 published?: CVE-2020-5326 was published on 2020-02-21 and last updated on 2026-06-17.

References

https://www.dell.com/support/article/SLN320337

Affected products (174)

cpe:2.3:o:dell:chengming_3980_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g3_3579_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g3_3590_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g3_3779_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g5_5587_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g5_5590_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_7588_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_7590_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_7790_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:embedded_box_pc_5000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_14_gaming_7466_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_14_gaming_7467_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_15_7572_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_15_gaming_7566_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_15_gaming_7567_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_15_gaming_7577_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3470_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3480_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3481_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3580_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3581_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3583_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3584_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3670_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3780_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_3781_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_5370_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_5480_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_5481_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_5482_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_5488_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_5570_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_5580_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_5582_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_5770_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_7380_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_7386_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_7472_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_7580_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_7586_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Dell Chengming 3980 Firmware

CVE-2022-32489 — High (CVSS 8.2): Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially…
CVE-2022-32488 — High (CVSS 8.2): Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially…
CVE-2022-26861 — High (CVSS 7.9): Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could…
CVE-2022-34398 — High (CVSS 7.5): Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user…
CVE-2022-32487 — High (CVSS 7.5): Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially…
CVE-2022-32485 — High (CVSS 7.5): Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially…

All CVEs affecting Dell Chengming 3980 Firmware →

Other CWE-306 (Missing Authentication for Critical Function) vulnerabilities

CVE-2026-54309 — Critical (CVSS 10.0): n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP…
CVE-2026-50242 — Critical (CVSS 10.0): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429…
CVE-2026-49257 — Critical (CVSS 10.0): mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1…
CVE-2026-46846 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
CVE-2026-46803 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
CVE-2026-46800 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).…

Browse all CWE-306 (Missing Authentication for Critical Function) vulnerabilities →