- Dell stored BIOS passwords on the chip using a scramble anyone can reverse.
- Any password up to 12 characters can be read back in full.
- Longer passwords can still be cracked using an old password's leftover key.
- Anyone with physical access to a stolen or lost Dell laptop can pull it out.
- A thin client Dell still sells and supports is affected.
Two researchers, Craig Blackie of MDSec and Darren McDonald of AmberWolf, found a flaw in many Dell computers. It stores the BIOS admin password on a memory chip using a scramble that can be reversed, not a one way lock. Anyone who gets the laptop in their hands can read the password straight off that chip. Dell tracks the bug as CVE-2026-40639.
MDSec Dell BIOS password research
The password sits in a 32 byte storage slot next to a 20 byte key that undoes the scramble. The very first letter of the password is never scrambled at all. For any password up to 12 characters, the empty space left over in that slot hands over the entire key, so the real password can be read straight back out.
Getting at the chip means having the machine in hand first. The researchers say an attacker can hook a clip and a cheap chip programmer to the flash chip to read it. An attacker could also boot their own software on the machine to get the same data. Once the chip is copied, pulling the password back out takes milliseconds with no guessing involved.
Passwords over 12 characters usually keep part of the word hidden, but the researchers found a way around that too. Old passwords are not erased when someone changes them, only marked as deleted, so they stay on the chip. If an older, shorter password used the same first letter as the current long one, its leaked key unlocks the current password as well.
The researchers tested the flaw on several Dell computers. They fully recovered passwords on a Latitude E7250, a Latitude 7490 and an XPS 15 9560. On a Wyse 5070 thin client that Dell still sells and supports, they recovered most of each password, with a few letters left uncertain. The OptiPlex 3000 uses a different method that hashes the password instead and was not affected, and the Latitude 5310 and XPS 15 9530 also were not affected.
Dell's CVE listing for the flaw, published in June 2026, rates it medium severity at 5.7 out of 10. The National Vulnerability Database says it needs physical access and no valid account, and could let an attacker gain higher level control of the machine. The researchers published their full technical writeup on July 10.
