Dell’s BIOS Password Flaw Leaves a Current Thin Client Unpatched

A flaw in how Dell stores BIOS administrator passwords lets anyone holding a flash dump pull the plaintext back out in milliseconds, no cracking involved. Dell tracks the bug as CVE-2026-40639, disclosed under advisory DSA-2026-197, and it traces to broken arithmetic standing in for real encryption. Researchers Craig S. Blackie of the UK security firm MDSec and Darren McDonald of AmberWolf found it by accident while chasing an unrelated pre-boot bug.

Dell already ships a proper fix elsewhere in its lineup. The OptiPlex 3000 hashes the password correctly. The Wyse 5070, a thin client Dell still sells and supports today, does not, and it remains confirmed vulnerable months after Dell first learned about the flaw.

How Dell’s Password Vault Breaks Its Own Math

Dell keeps BIOS administrator and user passwords inside part of the SPI flash chip called the DVAR region, short for Dell Variable. Rather than hashing the password the way most modern systems handle credentials, the firmware encrypts it with a repeating 20-byte XOR key stretched across a 32-byte field. The first character of the password is not encrypted at all; it sits in the flash as plain text.

The Short-Password Leak

For any password of 12 characters or fewer, the unused portion of that 32-byte field gets padded with zero bytes before the XOR runs. XORing a zero against a key byte just hands back the key byte itself.

Because the key is 20 bytes long and the field is 32, that padding leaks the entire key straight out of the record. Anyone who reads it can reverse any password of that length instantly, with no guessing involved.

Closing the Blind Zone on Longer Passwords

Longer passwords do not leave that tail exposed, and Dell leaned on that gap for part of its severity argument. Blackie and McDonald found a way around it anyway. Dell derives each device’s key from only three inputs: a fixed per-device seed, a GUID, and that single unencrypted first character of the password. That leaves just 256 possible keys per device.

Old, deleted DVAR records are not securely erased on top of that. An attacker can often recover a previous short password left behind on the chip, pull its key from that leftover record, and apply it to a longer, current password that happens to start with the same letter.

Dell classifies the underlying issue as a “Weak Encoding for Password” vulnerability in its own advisory for the Client Platform BIOS. The mechanism lives inside the SystemPwSmm driver, part of System Management Mode (SMM, a privileged firmware execution mode), common across Dell client platforms.

Two Researchers Stumbled into a Broken Cipher

Blackie and McDonald were not hunting for a password bug. The pair was mapping how Dell BIOS settings get written to flash for a separate pre-boot DMA research project, changing one setting at a time and diffing the bytes that moved.

The BIOS password was just one setting they exercised along the way, using a SOIC clip and a T48 programmer to read the chip. Their original goal with it was to delete the password, not read it.

Looking at the DVAR records is what exposed the flaw instead. Blackie and McDonald laid out the full recovery chain from flash dump to plaintext in a post published jointly with AmberWolf. The timeline from private tip to public writeup ran several months.

1. March 2026: Blackie and McDonald privately report the flaw to Dell.
2. June 9, 2026: Dell validates the research and publishes DSA-2026-197, patching an initial batch of platforms.
3. July 10, 2026: MDSec and AmberWolf publish their joint technical writeup.
4. End of July 2026: Dell’s stated target date for its remaining fixes, still unshipped as of publication.

That gap between the March report and the June advisory gave Dell roughly three months to prepare before going public. It has had more than a month since then to close the remaining holes, with a little over a week left before its own deadline.

A Score Dell Already Moved Once

Dell and the researchers agree on almost every part of the severity score and split on exactly one metric. Dell’s first internal assessment rated the flaw 4.3. After Blackie and McDonald argued for 6.1, Dell revised its own number up to 5.7, still short of what the researchers proposed.

The disagreement comes down to Attack Complexity. Dell calls it High, reasoning that recovery depends on a password’s original length, since a longer password does not hand over its key from a single record the way a short one does. The researchers call it Low, since the 256-key shortcut through old, undeleted records closes that gap in practice no matter how long the password is.

Neither side disputes that the exploit works. The argument is only about how easy Dell thinks it is to carry out, and that argument alone moved the public score by more than a full point.

Why the Wyse 5070 Stayed Exposed

Dell’s June 9 advisory patched a specific list: the Edge Gateway 3000 and 5000, the Embedded PC 3000 and 5000, the Precision 3630 Tower and 3930 Rack, and a range of Rugged Latitude models. It said nothing about four other machines the researchers had already confirmed vulnerable.

• Wyse 5070, a thin client Dell still sells and supports
• Latitude 7490, a mainstream business laptop
• XPS 15 9560, a consumer and prosumer laptop
• Latitude E7250, an older business laptop nearing end of support

Dell told the researchers the remaining platforms are targeted for a fix by the end of July, but a target is not a shipped patch. The Wyse 5070 stands apart from the other three.

It is not legacy hardware on its way out. It is a current thin client Dell markets for VDI and kiosk deployments right now, the kind of box that quietly runs point-of-sale terminals, hospital nursing stations, and call center desks, largely outside the reach of security reviews built around laptops.

Dell already knows how to fix this properly. The OptiPlex 3000 uses a SHA-256-based vault called SIVB and is not vulnerable at all. That is proof the company has a working fix, just not one it has finished rolling out.

Does This Break Full-Disk Encryption Too?

Not on its own, and not automatically. Recovering a Dell BIOS password does not decrypt a hard drive by itself. It can, though, hand an attacker control over Secure Boot, boot order, and pre-boot DMA settings, the same settings full-disk encryption schemes often lean on to trust that a machine has not been physically altered.

A BIOS administrator password is supposed to be a meaningful control.

Blackie and McDonald wrote that in their joint disclosure. Recovering the password, in their telling, strips away the control it was meant to provide in the first place.

That gap turns concrete when TPM policies do not measure every relevant setting, since a machine can still report a trusted boot state even after its configuration changed underneath it. Other researchers have shown the same pattern before.

A CovertSwarm test of TPM-protected machines found an open BIOS configuration let testers boot from a live USB and read the drive directly. Blackie and McDonald tell defenders plainly not to treat a BIOS password as a stand-in for full-disk encryption, and not to assume old records disappear just because a password was changed.

What Changes by the End of July

Dell has patching work left on a fixed calendar. Its own target puts the remaining fixes, including whatever it plans for the Wyse 5070, at the end of July 2026, a little over a week from now. Nothing in the public record confirms that date will hold, or that Wyse 5070 owners will see a patch inside it.

Pulling off the attack still takes physical access to the chip: either a clip and a cheap programmer wired straight to the flash, or booting an operating system the attacker controls. Neither path needs a password, a login prompt, or the machine’s owner to do anything at all.

The researchers’ fix recommendation to Dell is specific. Move every platform to salted, iterated password hashing, and securely erase historical DVAR records instead of just marking them deleted. Until that happens fleet-wide, they are telling IT teams not to lean on a BIOS password as the only thing standing between an attacker and an encrypted drive.

For now, that list still includes a thin client Dell sells today.

Frequently Asked Questions

Can This Dell BIOS Flaw Be Exploited Remotely?

No. Recovery requires physical access to the SPI flash chip itself, either through a clip and programmer or by booting an operating system the attacker controls on the target machine. That limits mass remote exploitation over the internet, though it does not help against a stolen or leased device, a hostile insider, or an unattended machine left alone in a hotel room or shared office.

Does Changing My BIOS Password Remove the Risk?

Not by itself. Old DVAR records are not securely erased when a password is changed, so a previous short password’s key can sometimes still be recovered from the chip and reused against a new password that happens to share the same first character.

Is My Dell Laptop Affected If It Is Not on the Confirmed List?

Possibly, and Dell has not ruled it out. The flaw affects the SystemPwSmm driver, which researchers describe as common across Dell client platforms well beyond the four machines confirmed vulnerable so far, so devices outside that list are not automatically in the clear.

What Should IT Teams Do Right Now?

Apply any Dell BIOS update offered for an affected model and check DSA-2026-197 periodically, since Dell has said the published list will grow. Beyond that, the researchers’ advice is to stop treating a BIOS password as a security boundary on its own and pair it with full-disk encryption that does not depend solely on that password.