# Dell BIOS Flaw (CVE-2026-40639 / DSA-2026-197) Lets Attackers Recover Admin Passwords From SPI Flash

> Dell Client Platform BIOS encodes admin/setup passwords with a flawed repeating 20-byte XOR key applied to a 32-byte field instead of cryptographic hashing, leaving the first character unencrypted and leaking key material for passwords of 12 characters or fewer. An attacker with physical access to the SPI flash chip (or an attacker-controlled OS boot) can dump the DVAR region and recover the admin password offline.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-18T08:51:53.062Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1200
- **ID:** TL-2026-1200
- **Severity:** HIGH (CVSS 5.7)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-40639

## Description

CVE-2026-40639 (Dell Security Advisory DSA-2026-197) is a Weak Encoding for Password vulnerability (CWE-261) in Dell Client Platform BIOS, discovered by Craig S. Blackie of MDSec and Darren McDonald of AmberWolf and privately disclosed to Dell in March 2026. Instead of using a salted cryptographic hash, Dell's BIOS setup/admin password is obfuscated by XORing the password against a repeating 20-byte device key across a fixed 32-byte storage field in the BIOS DVAR (Dell Variable) NVRAM region held in SPI flash. This construction has three independently exploitable weaknesses: (1) the first character of the password is stored completely unencrypted, immediately leaking one byte of plaintext; (2) for passwords of 12 characters or fewer, the remaining bytes of the 32-byte field are null-padded, and XORing a known zero byte against the stored ciphertext directly reveals the corresponding raw key bytes, allowing full key reconstruction without any password knowledge; (3) even for longer passwords where the padding trick does not apply, the per-device key is derived from a fixed seed combined with the system GUID and has only 256 possible values, making brute-force key recovery trivial once a flash dump is obtained. A further weakness is that historical DVAR records from earlier (shorter) passwords are not securely erased when a password is changed, so an attacker who obtains a flash dump can sometimes recover key material from a stale record even if the current password is long and 'safe.'

Exploitation requires either physical access to desolder/clip onto the SPI flash chip with an external programmer, or the ability to boot an attacker-controlled OS/utility (e.g. via flashrom) capable of reading the BIOS region while pre-boot protections have not yet locked flash access. This is consistent with MDSec's related March 2026 research ('Disabling Security Features in a Locked BIOS'), which used `flashrom -p internal -r dump.bin --ifd -i bios` and physical SPI clips to dump and later reflash modified firmware to Dell Latitude/Precision-class devices, and separately demonstrated patching NVRAM Setup variables (e.g. the VarStoreId 0x1 'Control Iommu Pre-boot Behavior' option at VarOffset 0x975 within GUID EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9) to silently disable Kernel DMA Protection while the UEFI menu still reports it as enabled -- persisting across official firmware updates. Combined with recovered BIOS admin credentials, an attacker can re-enable manufacturing/service modes, alter boot-chain and DMA-protection settings, and in TPM-only BitLocker configurations, use PCIe DMA (via tools such as PCILeech) to bypass full-disk encryption and boot protections and obtain SYSTEM-level code execution.

Dell rated the flaw CVSS 3.1 5.7 (Medium) using vector AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting the physical-access attack vector; the discovering researchers argued for a higher 6.1 score citing lower attack complexity than Dell's assessment. There is no public PoC exploit tool release and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing; exploitation has not been observed in the wild. Dell began shipping patched BIOS releases on 2026-06-04 for the first affected models, with the advisory published 2026-06-09 and additional platform fixes (including the Wyse 5070 thin client) still pending as of late July 2026.

## MITRE ATT&CK

- T1200 Hardware Additions
- T1542 Pre-OS Boot
- T1542.001 System Firmware
- T1112 Modify Registry
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1556 Modify Authentication Process
- T1068 Exploitation for Privilege Escalation
- T1547 Boot or Logon Autostart Execution
- T1547.006 Kernel Modules and Extensions
- T1082 System Information Discovery
- T1495 Firmware Corruption
- T1005 Data from Local System
- T1592 Gather Victim Host Information
- T1078 Valid Accounts
- T1548 Abuse Elevation Control Mechanism
- T1553 Subvert Trust Controls
- T1091 Replication Through Removable Media
- T1119 Automated Collection
- T1052 Exfiltration Over Physical Medium

## Sources

- [Dell BIOS Flaw Lets Attackers Recover Admin Passwords From SPI Flash](https://cybersecuritynews.com/dell-bios-flaw-admin-passwords/)
- [DSA-2026-197: Security Update for Dell Client Platform BIOS for a Weak Encoding for Password Vulnerability](https://www.dell.com/support/kbdoc/en-us/000453482/dsa-2026-197-security-update-for-dell-client-platform-bios-for-a-weak-encoding-for-password-vulnerability)
- [DSA-2026-197 (UK mirror)](https://www.dell.com/support/kbdoc/en-uk/000453482/dsa-2026-197-security-update-for-dell-client-platform-bios-for-a-weak-encoding-for-password-vulnerability)
- [CVE-2026-40639 - Dell Client Platform BIOS Weak Encoding Password Elevation of Privilege](https://cvefeed.io/vuln/detail/CVE-2026-40639)
- [Disabling Security Features in a Locked BIOS](https://www.mdsec.co.uk/2026/03/disabling-security-features-in-a-locked-bios/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1200