Firmware vulnerability allows rapid password recovery on affected Dell devices, raising concerns over enterprise hardware security

A newly disclosed security vulnerability in the BIOS firmware of several Dell devices could allow attackers to recover administrator and user BIOS passwords within seconds, according to cybersecurity researchers.

The flaw, identified as CVE-2026-40639 and documented in Dell’s security advisory DSA-2026-197, is linked to an insecure password storage method inside certain firmware components. Rather than exploiting weak passwords, attackers can take advantage of how BIOS credentials are encrypted and stored.

Although exploitation generally requires physical access to the affected device or low-level system access, successful attacks could bypass important firmware security protections that help secure the boot process.

Faulty Encryption Method Exposed BIOS Credentials

Researchers found that some Dell systems stored BIOS passwords using a weak repeating-key XOR encryption method instead of a stronger cryptographic protection mechanism.

The affected passwords are stored in the Dell Variable (DVAR) section of the SPI flash memory, where firmware settings are maintained. According to researchers, weaknesses in the encryption design allow sensitive key information to be recovered from stored password data.

The problem is particularly serious for shorter passwords because unused storage space in the encrypted password field can reveal portions of the encryption key. This enables attackers to recover passwords directly instead of attempting traditional password-cracking methods.

Even longer passwords may remain vulnerable because the system’s key-generation process relies on limited device-specific information, reducing the complexity required for recovery.

Researchers Identify Affected Dell Platforms

The vulnerability was discovered by security researchers Craig S. Blackie of MDSec and Darren McDonald of AmberWolf during an investigation into Dell UEFI firmware.

Their analysis identified issues in the SystemPwSmm firmware component, which is used across multiple Dell client systems. Testing confirmed exposure on devices including:

• Dell Latitude E7250
• Dell Latitude 7490
• Dell XPS 15 9560
• Dell Wyse 5070 thin client

Researchers noted that newer Dell platforms using the Security Information Vault Block design with SHA-256-based protection were not affected during testing.

The difference highlights that Dell has already implemented stronger firmware security methods on newer hardware, although some older systems remain dependent on the vulnerable design.

Attack Requires Access, But Impact Could Be Significant

The vulnerability is not considered a remote attack because hackers typically need physical access to a device or the ability to obtain a firmware image from the system.

However, once attackers gain access, recovering BIOS passwords can reportedly be performed without user interaction or authentication. This creates risks for corporate laptops, shared devices and systems used in environments where physical security cannot always be guaranteed.

BIOS passwords often protect settings related to Secure Boot, boot order changes and other pre-operating system controls. If compromised, attackers could potentially weaken security protections or interfere with systems protected by disk encryption technologies.

Security experts warn that firmware-level weaknesses are particularly dangerous because they operate beneath the operating system and can affect multiple layers of device security.

Dell Releases Updates and Advises Security Measures

The vulnerability was privately reported to Dell in March 2026. After reviewing the findings, Dell published its security advisory and began releasing firmware updates for affected product lines.

Initial updates covered several platforms, including Precision systems, Rugged Latitude devices, Embedded PCs and Edge Gateway products. Additional fixes for other affected models were expected as part of Dell’s broader remediation effort.

Suratgarh, Rajasthan: Police in Rajasthan’s Sri Ganganagar district have launched an investigation after a publishing distributor in Suratgarh was allegedly cheated of ₹9.5 lakh through a fraudulent bulk book order placed by individuals posing as representatives of educational institutions.

Investigators believe the suspects used forged documents, fake payment confirmations, and false corporate identities to obtain a large consignment of books without making any legitimate payment.

Fraudsters Used Fake Institutional Purchase Orders

According to the complaint, the accused approached the publisher claiming to be authorized procurement officials for reputed educational organizations. They allegedly submitted professional-looking purchase orders and maintained regular communication to gain the distributor’s confidence.

The suspects emphasized the urgency of the order, citing academic deadlines, and requested immediate dispatch of textbooks and reference materials. Trusting the authenticity of the documents and the buyer’s claimed credentials, the distributor released the consignment before receiving payment.

Fake Payment Proof Delayed Detection

To support the deception, the fraudsters allegedly shared fabricated bank transaction screenshots and counterfeit RTGS payment confirmations through messaging applications, creating the impression that the funds had already been transferred.

However, during a routine financial reconciliation, the publisher discovered that no payment had been credited to the company’s bank accounts.

Further inquiries revealed that the books had already been delivered and removed from the original destination. By the time the fraud was uncovered, the suspects had reportedly switched off their mobile phones, cut off communication, and shut down the fake digital platforms used during the transaction.

Police Probe Financial and Digital Evidence

Following the complaint, Suratgarh Police registered an FIR under relevant sections related to cheating, criminal breach of trust, and forgery involving electronic records.

Investigators are now examining digital evidence, including bank transaction records, mobile phone data, internet logs, and domain registration details, to identify those behind the fraud. Authorities are also working with telecom companies and financial institutions to trace the movement of the suspects and recover any possible evidence.

Businesses Urged to Strengthen Verification Procedures

The incident has prompted trade organizations and business associations to advise wholesalers and distributors to adopt stricter verification measures for high-value commercial transactions.

Industry experts recommend verifying buyer credentials directly with organizations, confirming receipt of funds through official banking channels rather than relying on payment screenshots, and avoiding the dispatch of goods until payments are fully credited.

Authorities say implementing stronger financial verification procedures can significantly reduce the risk of procurement fraud and protect businesses from similar scams in the future.

Cybercriminals have defrauded doctors across Telangana of nearly ₹30 crore since September 2024, prompting authorities to strengthen awareness campaigns and cybersecurity education within the healthcare sector.

The alarming figures were revealed during a cyber awareness programme organized by the Telangana Cyber Security Bureau (TGCSB) in Hyderabad. Senior officials warned that healthcare professionals are increasingly becoming targets of sophisticated online scams despite their educational and professional backgrounds.

Healthcare Professionals Under Growing Cyber Threat

Addressing representatives from various medical associations, TGCSB Director Shikha Goel highlighted the rising number of cybercrime incidents involving doctors and healthcare workers. She emphasized that cybercriminals are exploiting digital platforms to target individuals across all professions, including highly qualified medical practitioners.

Officials stressed that vigilance, awareness, and prompt reporting remain the strongest defenses against cyber fraud. The event focused on strengthening cooperation between law enforcement agencies and the medical fraternity to improve preparedness against evolving cyber threats.

More than 70 office-bearers from medical organizations across Telangana attended the session, including presidents, secretaries, treasurers, and senior representatives.

Investment Scams Responsible for Major Financial Losses

According to TGCSB data, at least 735 doctors have reported cybercrime-related incidents since September 2024, with total losses reaching approximately ₹29.88 crore.

Business and investment fraud emerged as the most damaging category, accounting for losses of ₹22.39 crore involving 127 victims. Investigators noted that fraudsters often lure professionals with promises of high returns, fake investment opportunities, and deceptive business schemes.

Authorities also reported a wide range of other cyber offences affecting doctors, including digital arrest scams, identity theft, impersonation fraud, fake advertisements, job-related scams, insurance fraud, cryptocurrency fraud, UPI-related cheating, matrimonial scams, and sextortion cases.

Authorities Stress Importance of Rapid Reporting

The Telangana Cyber Security Bureau urged victims to report cybercrime incidents immediately, especially during the critical “golden hour” after a fraudulent transaction occurs.

Officials explained that timely complaints through the national cybercrime helpline 1930 and the official cybercrime reporting portal can significantly improve the chances of freezing suspicious transactions and recovering stolen funds.

The bureau further warned that cybercriminals are employing increasingly advanced techniques to deceive victims, making awareness and quick action more important than ever.

Medical Associations Join Awareness Drive

Representatives from associations of paediatricians, cardiologists, dentists, orthopaedic surgeons, gynaecologists, and hospital administrators participated in the discussions. The groups pledged to work closely with authorities to spread cybersecurity awareness through hospitals, clinics, medical conferences, and professional training programmes.

Officials believe that expanding cyber awareness among healthcare professionals will play a key role in reducing financial fraud and strengthening digital security across the state’s medical community.

As cyber threats continue to evolve, law enforcement agencies are encouraging doctors and other professionals to remain cautious when responding to investment offers, unknown communications, and requests for sensitive financial information online.