HOMEVULNERABILITIESCVE-2020-26186
MEDIUM

CVE-2020-26186

CWE-642Published: January 8, 2021· Updated: Jun 17, 2026

6.8
CVSS v3.1

Official Description

Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to system memory may exploit this vulnerability by overwriting the RuntimeServices structure to execute arbitrary code in System Management Mode (SMM).

NVD Source

Technical Analysis

CVE-2020-26186 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 6.8.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorPhysical
Attack ComplexityLow
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Dell2 product(s)
inspiron 5675 firmwareinspiron 5675
Source: NVD CPE · 2 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://www.dell.com/support/kbdoc/en-us/000180645/dsa-2020-247-dell-client-platform-security-update-for-uefi-bios-runtimeservices-overwrite-vulnerability
ADVISORYhttps://www.dell.com/support/kbdoc/en-us/000180645/dsa-2020-247-dell-client-platform-security-update-for-uefi-bios-runtimeservices-overwrite-vulnerability

All References (2)

→
https://www.dell.com/support/kbdoc/en-us/000180645/dsa-2020-247-dell-client-platform-security-update-for-uefi-bios-runtimeservices-overwrite-vulnerabilityVendor Advisory
→
https://www.dell.com/support/kbdoc/en-us/000180645/dsa-2020-247-dell-client-platform-security-update-for-uefi-bios-runtimeservices-overwrite-vulnerabilityVendor Advisory

Quick Facts

CVE IDCVE-2020-26186
CVSS Score6.8 / 10
SeverityMEDIUM
WeaknessCWE-642
CISA KEVNo
Affected1 vendor(s)
PublishedJan 8, 2021

Related CVEs (CWE-642)

CVE-2020-27872
8.8
CVE-2018-15382
8.6
CVE-2024-8754
8.1
CVE-2019-9496
7.5
CVE-2025-49090
7.1
CVE-2024-22387
6.8

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2020-26186 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2020-26186·NVD