CVE-2019-18579 is a configuration vulnerability in Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3. The default setting "Enable Thunderbolt (and PCIe behind TBT) pre-boot modules" allows a local, unauthenticated attacker with physical access to perform a Direct Memory Access (DMA) attack during boot. This medium-severity vulnerability (CVSS 6.8) grants read or write access to main memory, leading to high impact on confidentiality, integrity, and availability. While no active exploits or public exploit code like Metasploit or ExploitDB entries are reported, the vulnerability has garnered some community discussion and media coverage, indicating awareness of the issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.1.3CPE matchmatch criteria | cpe:2.3:o:dell:xps_7390_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.