Dell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability.

published 2026-04-16 6 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-209501

cvss: 5.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits: 0; none known

Dell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability, leading to unauthorized access.

Patch / fix

fixed in 30

Dell Dell Pro 14 Essential PV14250 1.4.0
Dell Dell Pro Micro / QCM1255 1.9.1
Dell Dell Pro Slim / QCS1255 1.9.1
Dell Dell Pro Tower / QCT1255 1.9.1
Dell Alienware 16 Area-51 AA16250 1.9.0
Dell Alienware 16X Aurora AC16251 1.8.1
Dell Alienware 18 Area-51 AA18250 1.9.0
Dell Alienware Area-51 AAT225 1.11.0
Dell Alienware Aurora ACT1250 1.10.0
Dell Alienware m15 R6 1.42.0
Dell Alienware m15 R7 1.37.0
Dell Alienware m16 R1 1.32.0
Dell Alienware m16 R2 1.18.0
Dell Alienware m18 R1 1.32.0
Dell Alienware M18 R2 1.20.0
Dell Alienware x14 R2 1.30.1
Dell Alienware x16 R1 1.30.1
Dell Alienware X16 R2 1.18.1
Dell ChengMing 3900 1.37.0
Dell ChengMing 3910/3911 1.32.0
Dell ChengMing 3990 1.35.1
Dell ChengMing 3991 1.35.1
Dell Dell 14 DC14250 1.4.0
Dell Dell 14 Premium DA14250 1.5.1
Dell Dell 15 DC15250 1.6.0
Dell Dell 16 DC16250 1.7.0
Dell Dell 16 DC16251 1.7.0
Dell Dell 16 Premium DA16250 1.7.0
Dell Dell G15 5510 1.38.0
Dell Dell G15 5511 1.41.0

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 6 mo ago (2026-04-16)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.1	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Affected products

Dell Dell Pro 14 Essential PV14250
Dell Dell Pro Micro / QCM1255
Dell Dell Pro Slim / QCS1255
Dell Dell Pro Tower / QCT1255
Dell Alienware 16 Area-51 AA16250
Dell Alienware 16X Aurora AC16251
Dell Alienware 18 Area-51 AA18250
Dell Alienware Area-51 AAT225
Dell Alienware Aurora ACT1250
Dell Alienware m15 R6
Dell Alienware m15 R7
Dell Alienware m16 R1
Dell Alienware m16 R2
Dell Alienware m18 R1
Dell Alienware M18 R2
Dell Alienware x14 R2
Dell Alienware x16 R1
Dell Alienware X16 R2
Dell ChengMing 3900
Dell ChengMing 3910/3911
Dell ChengMing 3990
Dell ChengMing 3991
Dell Dell 14 DC14250
Dell Dell 14 Premium DA14250
Dell Dell 15 DC15250
Dell Dell 16 DC16250
Dell Dell 16 DC16251
Dell Dell 16 Premium DA16250
Dell Dell G15 5510
Dell Dell G15 5511
Dell Dell G15 5520
Dell Dell G15 5530
Dell Dell G16 7620
Dell Dell G16 7630
Dell Dell G5 5000
Dell Dell Pro 13 Plus PB13250
Dell Dell Pro 13 Plus PB13255
Dell Dell Pro 13 Premium PA13250
Dell Dell Pro 14 PC14250
Dell Dell Pro 14 Plus PB14250
Dell Dell Pro 14 Plus PB14255
Dell Dell Pro 14 Premium PA14250
Dell Dell Pro 15 Essential PV15250
Dell Dell Pro 16 PC16250
Dell Dell Pro 16 Plus PB16250
Dell Dell Pro 16 Plus PB16255
Dell Dell Pro 24 All-in-One Plus/Dell Pro 24 All-in-One
Dell Dell Pro Laptop PC14250
Dell Dell Pro Laptop PC16250
Dell Dell Pro Max 14 MC14250

Classification

Weakness

CWE-640 Weak Password Recovery Mechanism for Forgotten Password

References

dell.com /support/kbdoc/en-us/000300450/dsa-2025-153
vendor-advisory

Sources

CVE List CVE-2025-36579
NVD CVE-2025-36579

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary