Dell BIOS Flaw Lets Attackers Recover Passwords From SPI Flash

A newly disclosed critical flaw in how Dell stores BIOS administrator and user passwords allows full recovery of plaintext credentials from a flash dump in milliseconds. Tracked as CVE-2026-40639 (DSA-2026-197), the issue stems from a broken XOR encryption scheme rather than a cryptographic hash. Dell’s DVAR (Dell Variable) region on the SPI flash stores passwords […] The post Dell BIOS Flaw Lets Attackers Recover Passwords From SPI Flash appeared first on Cyber Security News.

A newly disclosed critical flaw in how Dell stores BIOS administrator and user passwords allows full recovery of plaintext credentials from a flash dump in milliseconds. Tracked as CVE-2026-40639 (DSA-2026-197), the issue stems from a broken XOR encryption scheme rather than a cryptographic hash. Dell’s DVAR (Dell Variable) region on the SPI flash stores passwords in 32-byte records, encrypted with a 20-byte repeating XOR key. The first character is stored unencrypted, and any unused bytes beyond the password length are null-padded before encryption. Critical Dell BIOS Vulnerability Since XORing zero with a key byte simply outputs that key byte, the null padding leaks the encryption key directly into the stored record. For passwords of 12 characters or fewer, the entire 20-byte key leaks through this padding, enabling instant, exact recovery with no brute force and no known plaintext required. Longer passwords leave a “blind zone,” but the researchers found the key itself is derived from just 256 possible values per device (based on a fixed device seed, GUID, and the single unencrypted first byte), so historical password records left in the log-structured DVAR store can supply the same key and close the gap entirely. The flaw affects the SystemPwSmm SMM driver used broadly across Dell client platforms, not just legacy hardware. MDsec confirmed that vulnerable devices include the Latitude E7250, XPS 15 9560, Latitude 7490, and notably the current-generation Wyse 5070 thin client, which remains supported and unpatched. Dell has fixed the issue on newer platforms using a SHA-256-based SIVB vault, but DSA-2026-197’s initial patch list excludes all four confirmed-vulnerable devices; Dell has targeted broader remediation for the end of July 2026. Exploitation requires physical access to read the SPI flash (via a clip and a cheap programmer, or by booting an attacker-controlled OS) but no authentication or brute-forcing. The researchers score it CVSS 6.1, disputing Dell’s Attack Complexity rating of “High” since recovery is fully deterministic once flash access is obtained. The greatest risk lies in a full-disk-encryption bypass: recovering the BIOS password can allow an attacker to disable Secure Boot or pre-boot DMA protection settings that are not always reflected in TPM PCRs, potentially unlocking encrypted storage. Reused BIOS passwords across an estate, or residual historical passwords surviving on resold hardware, extend the blast radius well beyond a single device. Mitigation Dell should hash (not encrypt) passwords using PBKDF2, bcrypt, or Argon2, and securely erase old DVAR records on password change. Defenders should treat BIOS passwords as obfuscation, not protection, and layer in Secure Boot with owner-enrolled keys, TPM-measured boot, and properly bound disk encryption. Organizations should avoid shared BIOS passwords across device fleets and enforce strict disposal controls for retired hardware. Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google. The post Dell BIOS Flaw Lets Attackers Recover Passwords From SPI Flash appeared first on Cyber Security News.