Hackers Exploit Dell BIOS Vulnerability to Recover Admin Passwords in Seconds

Post Views: 147

A critical flaw in the BIOS password protection system of several Dell devices allows attackers with physical access to retrieve administrator and user BIOS passwords in milliseconds, compromising security features on affected Latitude, XPS, and Wyse models.

Flawed Encryption Mechanism Exposes Passwords

The vulnerability stems from the use of an insecure repeating-key XOR encryption scheme to store BIOS passwords within the Dell Variable (DVAR) region of the SPI flash memory chip. Passwords are stored in a 32-byte field encrypted with a 20-byte key, with the first character of the password stored in plaintext regardless of length. For passwords 12 characters or shorter, the remaining 20 bytes of the 32-byte field are null-padded and XORed with zero, exposing the full encryption key. This allows attackers to reverse any such password instantly without brute-force methods. Even longer passwords are not entirely secure, as the key derivation process relies on a fixed per-device seed, a GUID, and the unencrypted first character, reducing the key space sufficiently to enable decryption using historical password records from the log-structured DVAR store.

Affected Systems and Discovery

The flaw was uncovered by security researchers Craig S. Blackie of MDSec and Darren McDonald of AmberWolf during an unrelated investigation into a pre-boot DMA vulnerability in Dell UEFI firmware. Their analysis confirmed that the SystemPwSmm firmware component, used across multiple Dell client platforms, is impacted. Specifically, the vulnerability affects the Latitude E7250, Latitude 7490, XPS 15 9560, and the Wyse 5070 thin client. Newer Dell systems, such as the OptiPlex 3000 series, employ a more secure SHA-256-based Security Information Vault Block design and were not found vulnerable, indicating that Dell has implemented a proper fix for newer models. However, legacy devices remain at risk.

Dell assigned the flaw a CVSS score of 5.7, citing high attack complexity, while the researchers argue for a 6.1 rating, emphasizing the deterministic and low-complexity nature of password recovery once a flash dump is obtained.

Real-World Implications and Mitigation Efforts

BIOS passwords often control critical pre-boot settings such as Secure Boot configuration and boot order, making their compromise a significant risk. Attackers could disable security mechanisms or weaken full-disk encryption, particularly on systems where TPM policies do not monitor all firmware changes. Exploitation requires physical access to read the SPI flash chip using an inexpensive clip and programmer or the ability to boot an attacker-controlled operating system. Once access is gained, no further authentication or user interaction is needed, posing a serious threat to enterprise laptops, shared systems, and devices in unsecured environments.

Researchers privately disclosed the issue to Dell in March 2026, and the company validated the findings before releasing DSA-2026-197 on June 9, 2026, alongside firmware updates for an initial set of platforms, including Precision, Rugged Latitude, Embedded PC, and Edge Gateway devices. However, the confirmed-vulnerable Latitude E7250, Latitude 7490, XPS 15 9560, and Wyse 5070 were not included in the first patch round, with Dell planning broader remediation by late July 2026.

Experts highlight that firmware-level vulnerabilities represent some of the most severe hardware security risks, as they operate below the operating system and can undermine multiple layers of protection. Organizations are advised to apply Dell’s firmware updates promptly, restrict physical access to corporate devices, enable Secure Boot and TPM protections where possible, and avoid relying solely on BIOS passwords for securing sensitive systems.