CVE-2025-36579: Weak Password Recovery in Dell BIOS

The primary impact of CVE-2025-36579 is unauthorized access to the system. Because exploitation requires physical access, the attack vector is limited. However, successful exploitation could allow an attacker to modify system settings, install malicious software, or exfiltrate sensitive data stored on the device. The blast radius is limited to the compromised system itself, but the potential for data theft or system compromise remains significant. This vulnerability highlights the importance of physical security controls alongside software-based security measures.

1. Reserved2025-04-15
2. Published2026-04-16
3. EPSS updated2026-04-24

The primary mitigation for CVE-2025-36579 is to upgrade the Dell BIOS to version 2.39.0 or later. Dell has released a BIOS update specifically addressing this vulnerability. If an immediate upgrade is not feasible due to compatibility concerns or system downtime requirements, consider implementing enhanced physical security measures, such as restricting physical access to the server room and utilizing physical security devices like locked cabinets and surveillance cameras. After upgrading the BIOS, verify the password recovery mechanism functions as expected and that unauthorized access is prevented.