New Delhi: Dell reportedly fixed a patch of high-severity vulnerabilities, which have remained present and undisclosed in its devices for over 12 years and affected hundreds of millions of devices worldwide, making its computers going back to year 2009.
“The impact this could have on users and enterprises that fail to patch is far reaching and significant,” said Kasif Dekel, Senior Security Researcher at SentinelOne.
While the cybersecurity firm has not seen any indicators that these vulnerabilities have been exploited in the wild up till now, with hundreds of million of enterprises and users currently vulnerable, “it is inevitable that attackers will seek out those that do not take the appropriate action”.
The list of affected Dell computers has over 380 models, including some of the latest XPS 13 and 15 models, and the G3, G5, and G7 gaming laptops.
Dell has also listed almost 200 affected computers that it considers to be no longer receiving service.
Both Dell and SentinelLabs, however, stressed they haven’t seen evidence of the vulnerability being exploited by hackers.
The high severity flaws could allow any user on the computer, even without privileges, to escalate their privileges and run code in kernel mode.
“Among the obvious abuses of such vulnerabilities are that they could be used to bypass security products,” the report said.
An attacker with access to an organisation’s network may also gain access to execute code on unpatched Dell systems and use this vulnerability to gain local elevation of privilege. Attackers can then leverage other techniques to pivot to the broader network, like lateral movement.
“These multiple high-severity vulnerabilities in Dell software could allow attackers to escalate privileges from a non-administrator user to kernel mode privileges,” the report noted.