CVE-2026-40639

Name of the Vulnerable Software and Affected Versions Dell Client Platform BIOS (affected versions not specified) Latitude E7250 Latitude 7490 XPS 15 9560 Wyse 5070

Description An unauthenticated attacker with physical access to the SPI flash chip or an attacker-controlled OS boot can recover BIOS administrator and user passwords in milliseconds. The issue stems from the SystemPwSmm SMM driver storing passwords in the DVAR region of the SPI flash using a weak XOR encryption scheme instead of a secure hash. For passwords up to 12 characters, null-padding in the 32-byte storage field leaks the 20-byte encryption key directly. For longer passwords, the key is derived from device-static data and the first byte of the password, which is stored in cleartext, limiting the possibilities to 256 keys per device. Additionally, because the DVAR is log-structured, deleted password records persist, potentially allowing the recovery of keys for current passwords. Exploiting this flaw can lead to elevation of privileges, allowing an attacker to disable Secure Boot, change boot order, and potentially bypass full-disk encryption by breaking TPM-backed BitLocker chains.

Recommendations For Latitude E7250, Latitude 7490, XPS 15 9560, and Wyse 5070, update the BIOS to the version released by the end of July 2026. For Edge Gateway, Embedded PC, Precision, and Rugged Latitude lines, apply the security patches issued in June 2026. As a mitigation measure, do not rely solely on BIOS passwords to protect encrypted boot chains.