Dell Fixes Multiple BIOS Vulnerabilities Affecting Millions of Its Computers

Written by Bill Toulas
Last updated September 23, 2021

Only about a month after Dell decided to fix a 12-years-old vulnerability in a BIOS driver that was to be found in about 100 million Dell computers, the company is now releasing remediations for multiple security vulnerabilities affecting BIOSConnect and HTTPS Boot. In this case, the scope of affection covers 129 consumer and business laptops, desktops, and tablets, corresponding to roughly 30 million devices. Notably, those protected by superior security systems such as “Secure Book” and “Dell Secured-Core” are also vulnerable.

These are the flaws discovered by Eclypsium researchers and which have compelled Dell to release an urgent mitigation advisory:

Source: Eclypsium

The implications of exploiting CVE-2021-21571 include arbitrary remote code execution in the UEFI (pre-boot) environment without any additional prerequisite. This opens up quite a wide spectrum of attack potential, like man-in-the-middle attacks or even full system takeover. The problem lies in the fact that connection requests to the backend Dell HTTP server accept any valid wildcard certificate, so impersonation is made possible after the trivial retrieval of the relevant files.

For a full list of the affected Dell models, check out the company’s advisory as it’s too extensive to share here. BIOSConnect is part of SupportAssist, which comes pre-installed on most Windows-based Dell devices, so the problem is quite extensive.

Dell has promised to roll out fixing patches for all affected models until the end of July 2021, so until then, apply the proposed mitigations. For now, the mitigating recommendation is to update to the latest Dell Client BIOS versions as soon as practically possible. If that’s impossible or if there’s no available update for your model yet, disabling BIOSConnect and HTTPS Boot should do the trick. You may do this through the BIOS Setup Menu, under “Update, Recovery → BIOS Connect”, and “Connection → HTTPS Boot”.

For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: