Dell BIOS Flaw Lets Attackers Recover Admin Passwords From SPI Flash in Milliseconds Cybersecurity

Tracked as CVE-2026-40639 and addressed in Dell Security Advisory DSA-2026-197, the issue affects certain Dell client platforms that use the proprietary DVAR configuration store and the SystemPwSmm SMM driver. The issue is tracked as CVE-2026-40639. It affects the SystemPwSmm SMM driver used broadly across Dell client platforms, confirmed on the Latitude E7250, Latitude 7490, XPS 15 9560, and notably the current-generation, supported Wyse 5070 thin client, which remains unpatched.

TL;DR

• Dell […] The post Dell BIOS Flaw Lets Attackers Extract Plaintext Passwords Without Brute Force appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
• A critical flaw in how Dell stores BIOS administrator and user passwords allows full password recovery from a flash dump in milliseconds, with no brute force required.
• Dell validated the findings and issued DSA-2026-197 on June 9, 2026, patching an initial batch of platforms (Edge Gateway, Embedded PC, Precision, and Rugged Latitude lines), with additional fixes targeted for the end of July 2026.

Independent reporting: This account is corroborated by 2 independent sources, including primary advisories where available.

How the iOS Incident Unfolded

The researchers and Dell disagree slightly on CVSS scoring: Dell rates it 5.7, while the researchers argue for 6.1, based on differing views of Attack Complexity.

Further details indicate that the researchers recommend Dell move to salted, iterated password hashing across all platforms and securely erase historical DVAR records, while advising defenders not to rely on BIOS passwords alone to protect encrypted boot chains.

Longer passwords leave a small blind zone, but the researchers found a way around it: Dell’s key derivation uses only a fixed per-device seed, a GUID, and the single unencrypted first character of the password.

Newer models like the OptiPlex 3000 use a proper SHA-256-based SIVB vault and are not vulnerable, showing Dell has a fix available but hasn’t rolled it out everywhere.

Technical Details

CVEs:

• CVE-2026-40639

Technical specifics on the underlying mechanism remain under review by security researchers.

Impact

It affects the SystemPwSmm SMM driver used broadly across Dell client platforms, confirmed on the Latitude E7250, Latitude 7490, XPS 15 9560, and notably the current-generation, supported Wyse 5070 thin client, which remains unpatched. Newer models like the OptiPlex 3000 use a proper SHA-256-based SIVB vault and are not vulnerable, showing Dell has a fix available but hasn’t rolled it out everywhere. Dell validated the findings and issued DSA-2026-197 on June 9, 2026, patching an initial batch of platforms (Edge Gateway, Embedded PC, Precision, and Rugged Latitude lines), with additional fixes targeted for the end of July 2026.

Timeline

| Date | Event | |, , |, , -| | 7250 | It affects the SystemPwSmm SMM driver used broadly across Dell client platforms, confirmed on the Latitude E7250, Lat… | | 2026 | Researchers privately disclosed the issue to Dell in March 2026. | | 2026 | Tracked as CVE-2026-40639 and addressed in Dell Security Advisory DSA-2026-197, the issue affects certain Dell client… |

What To Do Now

1. Longer passwords leave a small blind zone, but the researchers found a way around it: Dell’s key derivation uses only a fixed per-device seed, a GUID, and the single unencrypted first character of the password.

2. It affects the SystemPwSmm SMM driver used broadly across Dell client platforms, confirmed on the Latitude E7250, Latitude 7490, XPS 15 9560, and notably the current-generation, supported Wyse 5070 thin client, which remains unpatched.

3. Newer models like the OptiPlex 3000 use a proper SHA-256-based SIVB vault and are not vulnerable, showing Dell has a fix available but hasn’t rolled it out everywhere.

4. Dell validated the findings and issued DSA-2026-197 on June 9, 2026, patching an initial batch of platforms (Edge Gateway, Embedded PC, Precision, and Rugged Latitude lines), with additional fixes targeted for the end of July 2026.

5. The researchers recommend Dell move to salted, iterated password hashing across all platforms and securely erase historical DVAR records, while advising defenders not to rely on BIOS passwords alone to protect encrypted boot chains.

Analysis

This disclosure adds to a growing pattern of significant vulnerabilities affecting enterprise infrastructure.