Dell Client BIOS Arbitrary Write (DSA-2026-280)

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#

include('compat.inc');

if (description)
{
  script_id(341114);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/28");

  script_cve_id("CVE-2026-63693");
  script_xref(name:"IAVA", value:"2026-A-0910");

  script_name(english:"Dell Client BIOS Arbitrary Write (DSA-2026-280)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a BIOS that is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Dell Client BIOS contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low
privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Write.

Note that Nessus has not tested for this issue but has instead relied only on the BIOS version.");
  # https://www.dell.com/support/kbdoc/en-us/000501826/dsa-2026-280-security-update-for-dell-client-platform-bios-for-an-improper-link-resolution-before-file-access-link-following-vulnerability
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9116c776");
  script_set_attribute(attribute:"solution", value:
"Update the BIOS per the vendor advisory.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63693");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dell:bios");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("bios_get_info_wmi.nbin");
  script_require_keys("BIOS/Model", "BIOS/Version", "BIOS/Vendor");

  exit(0);
}

include('vcf_extras.inc');

var app_name = 'Dell Inc.';
var app_info = vcf::dell_bios_win::get_app_info(app:app_name);
var model = app_info['model'];

if (!model)
  exit(0, 'The model of the device running the Dell BIOS could not be identified.');

var model_fixes = {
  'Alienware Area-51 AAT2265': '1.8.1',
  'Alienware Area-51m R2': '1.37.0',
  'Alienware Aurora R13': '1.33.0',
  'Alienware Aurora R15': '1.29.0',
  'Alienware Aurora R15 AMD': '1.26.0',
  'Alienware Aurora R16': '2.25.0',
  'Alienware Aurora Ryzen Edition R14': '2.32.0',
  'Alienware m15 R3': '1.37.0',
  'Alienware m15 R4': '1.35.0',
  'Alienware m17 R3': '1.37.0',
  'Alienware m17 R4': '1.35.0',
  'Alienware x15 R1': '1.34.0',
  'Alienware x17 R1': '1.34.0',
  'Inspiron 15 3510': '1.30.0',
  'Inspiron 15 3521': '1.25.0',
  'XPS 8950': '1.33.0',
  'XPS 8960': '2.24.0'
};

var fix = model_fixes[model];

if (isnull(fix))
{
  foreach var key (keys(model_fixes))
  {
    if (key >< model)
    {
      fix = model_fixes[key];
      break;
    }
  }
}

if (isnull(fix))
  audit(AUDIT_HOST_NOT, 'an affected model');

var constraints = [{ 'fixed_version' : fix, 'fixed_display': fix + ' for ' + model }];

app_info.app = 'Dell System BIOS for ' + model;

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);