IGI Logo

Dell has issued a security patch for millions of its computers dating back to 2009, after cybersecurity research firm SentinelLabs found five serious bugs in Dell and Alienware software that allow hackers to gain full permissions in Windows on the devices.

These high-severity vulnerabilities, which have remained present and undisclosed for 12 years in Dell devices for 12 years, affect hundreds of millions of devices and millions of users worldwide.

"The impact this could have on users and enterprises that fail to patch is far reaching and significant," said Kasif Dekel, Senior Security Researcher at SentinelOne.

While the cybersecurity firm has not seen any indicators that these vulnerabilities have been exploited in the wild up till now, with hundreds of million of enterprises and users currently vulnerable, "it is inevitable that attackers will seek out those that do not take the appropriate action".

The list of affected Dell computers has over 380 models, including some of the latest XPS 13 and 15 models, and the G3, G5, and G7 gaming laptops.

Dell has also listed almost 200 affected computers that it considers to be no longer receiving service.

Both Dell and SentinelLabs, however, stressed they haven't seen evidence of the vulnerability being exploited by hackers.

The high severity flaws could allow any user on the computer, even without privileges, to escalate their privileges and run code in kernel mode.

"Among the obvious abuses of such vulnerabilities are that they could be used to bypass security products," the report said.

An attacker with access to an organisation's network may also gain access to execute code on unpatched Dell systems and use this vulnerability to gain local elevation of privilege. Attackers can then leverage other techniques to pivot to the broader network, like lateral movement.

"These multiple high-severity vulnerabilities in Dell software could allow attackers to escalate privileges from a non-administrator user to kernel mode privileges," the report noted.