Key Takeaways
- Dell BIOS administrator and user passwords are stored in the DVAR region of the SPI flash using a weak repeating‑byte XOR scheme rather than a strong hash.
- For passwords ≤ 12 characters, the unused portion of the 32‑byte field is XOR‑ed with zero, directly exposing the 20‑byte XOR key and allowing instant password recovery.
- Even longer passwords can be cracked because the key is derived from a fixed per‑device seed, a GUID, and the first (unencrypted) character of the password, yielding only 256 possible keys per system.
- Old, non‑securely‑erased DVAR records often contain shorter passwords; recovering those reveals the key, which can then be applied to a current longer password sharing the same initial letter.
- The flaw resides in the SystemPwSmm SMM driver and affects many Dell client platforms (e.g., Latitude E7250, Latitude 7490, XPS 15 9560, Wyse 5070 thin client) while newer models that use a SHA‑256‑based SIVB vault remain safe.
- Exploitation requires physical access to the flash chip or the ability to boot an attacker‑controlled OS, but no authentication or user interaction is needed.
- Researchers privately reported the issue in March 2026; Dell released advisory DSA‑2026‑197 on June 9 2026, patching an initial set of platforms with further fixes planned for late July 2026, though the Wyse 5070 and several other vulnerable devices remain unpatched.
- Dell rates the vulnerability CVSS 5.7; the researchers argue for CVSS 6.1 based on a stricter assessment of attack complexity.
- Mitigation advice includes moving to salted, iterated password hashing on all platforms, securely erasing historical DVAR records, and not relying solely on BIOS passwords to protect encrypted boot chains.
- The source text also contains an unrelated promotional line about an “AI SOC SLA Guide,” which is not part of the vulnerability discussion.
Overview of the Vulnerability
A critical flaw in Dell’s BIOS password storage mechanism allows an attacker to recover the administrator or user password in milliseconds without any brute‑force effort. The issue is catalogued as CVE‑2026‑40639 (Dell Security Advisory DSA‑2026‑197) and stems from a broken XOR‑based encryption scheme rather than a proper cryptographic hash. Because the encryption is reversible and the key can be derived directly from the stored data, an attacker who obtains a flash dump canned a copy of the SPI flash contents can instantly reconstruct the plaintext password.
How Dell Stores BIOS Passwords
Dell places BIOS passwords in the DVAR (Dell Variable) region of the SPI flash chip. Each password is written into a fixed 32‑byte field and encrypted using a repeating 20‑byte XOR key. The algorithm XORs each byte of the password (padded with null bytes to fill the 32‑byte buffer) with the corresponding byte of the key, wrapping the key after its 20th byte. Notably, the very first character of the password is stored completely unencrypted, providing a known‑plaintext byte that aids cryptanalysis.
Key Leakage for Short Passwords
When a password is 12 characters or fewer, the remaining bytes of the 32‑byte field are null‑padded. XOR‑ing a null byte with the key leaves the key byte unchanged, so the tail of the stored record contains raw key material. Because the key is only 20 bytes long while the field is 32 bytes, the mismatched lengths cause the entire 20‑byte XOR key to be exposed directly in the record. With the key in hand, recovering the password is a trivial XOR operation, requiring no guessing or computational effort.
Deriving Keys for Longer Passwords
For passwords longer than 12 characters, the null‑padded tail no longer exists, so the key is not directly visible. However, Dell’s key derivation process is flawed: it uses only a fixed per‑device seed, a system‑specific GUID, and the first (unencrypted) character of the password. Since the first character is known and the seed/GUID are constant for a given machine, there are only 256 possible XOR keys (one for each possible value of the first character). An attacker can therefore try all 256 keys, which is still negligible in time, to decrypt any password whose first letter matches that used during key generation.
Leveraging Old DVAR Records
Dell does not securely erase previous DVAR entries when a password is changed. Consequently, older records often contain shorter passwords that were stored under the same XOR key scheme. By extracting an old short password, an attacker can recover the exact 20‑byte XOR key (as described for short passwords) and then apply that key to the current password record, provided the two passwords share the same initial character. This technique effectively removes the small “blind zone” that longer passwords might otherwise create.
Discovery and Researchers
The vulnerability was uncovered by Craig S. Blackie of MDSec and Darren McDonald of AmberWolf while they were investigating Dell UEFI firmware for unrelated pre‑boot DMA issues. Their analysis of the SystemPwSmm SMM driver revealed the weak XOR construction and the insufficient handling of historical DVAR data. The researchers privately disclosed the findings to Dell in March 2026, giving the vendor time to develop a remediation before public release.
Affected Platforms and Safer Models
The flaw impacts the SystemPwSmm SMM driver used across a broad range of Dell client systems. Confirmed vulnerable devices include the Latitude E7250, Latitude 7490, XPS 15 9560, and the current‑generation, still‑supported Wyse 5070 thin client. Notably, newer models such as the OptiPlex 3000 series employ a proper SHA‑256‑based SIVB vault for BIOS credentials and are not affected, demonstrating that Dell possesses a secure alternative but has not yet deployed it universally.
Security Impact and Attack Requirements
Because BIOS passwords often gate critical security features—Secure Boot, boot order changes, and pre‑boot DMA protections—recovering them can facilitate bypassing full‑disk encryption, especially when TPM policies do not measure every relevant boot setting. The actual exploitation requires either physical access to the flash chip (using a clip and programmer) or the ability to boot an attacker‑controlled operating system that can read the SPI flash. No authentication, user interaction, or software vulnerability on the host OS is needed, making the attack feasible for anyone with brief hardware access.
Disclosure Timeline, Patching, and CVSS Dispute
After validating the researchers’ report, Dell issued DSA‑2026‑197 on June 9 2026, releasing patches for an initial batch of platforms—including Edge Gateway, Embedded PC, Precision, and certain Rugged Latitude lines. Additional fixes were scheduled for rollout by the end of July 2026. However, the advisory does not yet cover the Wyse 5070 or several other confirmed‑vulnerable models, leaving those systems exposed until further updates arrive. Regarding severity, Dell assigns a CVSS score of 5.7, while the researchers advocate for 6.1, arguing that the attack complexity is lower than Dell’s assessment due to the reliable key recovery method.
Recommendations from Researchers and Dell
The researchers urge Dell to replace the XOR scheme with salted, iterated password hashing across all firmware platforms and to ensure that historical DVAR records are securely overwritten or erased when passwords are changed. They also advise defenders not to rely solely on BIOS passwords to protect encrypted boot chains; instead, they should enable additional layers such as measured boot, TPM‑bound secrets, and pre‑boot authentication mechanisms. Implementing these mitigations would eliminate the trivial key recovery path and raise the effort required for any firmware‑based credential attack.
Note on Unrelated Content
The source text concludes with a promotional line—“Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide”—which is unrelated to the BIOS password vulnerability and appears to be extraneous marketing material. This line does not affect the technical summary and is included here only for completeness of the source content.