Cyber Resilience

CVE-2021-21571

Medium

Published: 24 June 2021

Published
24 June 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
EPSS Score 0.0027 50.9th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-21571 is a medium-severity Improper Certificate Validation (CWE-295) vulnerability in Dell Alienware M15 R6 Firmware. Its CVSS base score is 5.9 (Medium).

Operationally, ranked in the top 49.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability using a person-in-the-middle attack which may lead to a denial…

more

of service and payload tampering.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

dell
alienware m15 r6 firmware
≤ 1.3.3
dell
chengming 3990 firmware
≤ 1.4.1
dell
chengming 3991 firmware
≤ 1.4.1
dell
g15 5510 firmware
≤ 1.4.0
dell
g15 5511 firmware
≤ 1.3.3
dell
g3 3500 firmware
≤ 1.9.0
dell
g5 5500 firmware
≤ 1.9.0
dell
g7 7500 firmware
≤ 1.9.0
dell
g7 7700 firmware
≤ 1.9.0
dell
inspiron 14 5418 firmware
≤ 2.1.0_a06
+118 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-295

When certificates are used to establish component provenance, the control requires correct certificate validation procedures.

addresses: CWE-295

Mandates approved trust anchors and issuance policies, directly preventing acceptance of unvalidated or untrusted certificates.

addresses: CWE-295

Correct system time is required for proper enforcement of certificate notBefore/notAfter dates and time-based revocation checks.

References