Lucene search

DellCVE-2022-32490

HistoryJan 18, 2023 - 6:15 a.m.

CVE-2022-32490

2023-01-1806:15:11

CWE-20

dell

web.nvd.nist.gov

dell

bios

vulnerability

input validation

smi

code execution

smram

cve-2022-32490

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

Affected configurations

Nvd

Vulners

Node

delledge_gateway_3000_firmwareRange<1.9.0

AND

delledge_gateway_3000Match-

Node

delledge_gateway_5000_firmwareRange<1.19.0

AND

delledge_gateway_5000Match-

Node

dellembedded_box_pc_3000_firmwareRange<1.15.0

AND

dellembedded_box_pc_3000Match-

VendorProductVersionCPE
delledge_gateway_3000_firmware*cpe:2.3:o:dell:edge_gateway_3000_firmware:*:*:*:*:*:*:*:*
delledge_gateway_3000-cpe:2.3:h:dell:edge_gateway_3000:-:*:*:*:*:*:*:*
delledge_gateway_5000_firmware*cpe:2.3:o:dell:edge_gateway_5000_firmware:*:*:*:*:*:*:*:*
delledge_gateway_5000-cpe:2.3:h:dell:edge_gateway_5000:-:*:*:*:*:*:*:*
dellembedded_box_pc_3000_firmware*cpe:2.3:o:dell:embedded_box_pc_3000_firmware:*:*:*:*:*:*:*:*
dellembedded_box_pc_3000-cpe:2.3:h:dell:embedded_box_pc_3000:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	edge_gateway_3000_firmware	*	cpe:2.3:o:dell:edge_gateway_3000_firmware::::::::
dell	edge_gateway_3000	-	cpe:2.3:h:dell:edge_gateway_3000:-:::::::*
dell	edge_gateway_5000_firmware	*	cpe:2.3:o:dell:edge_gateway_5000_firmware::::::::
dell	edge_gateway_5000	-	cpe:2.3:h:dell:edge_gateway_5000:-:::::::*
dell	embedded_box_pc_3000_firmware	*	cpe:2.3:o:dell:embedded_box_pc_3000_firmware::::::::
dell	embedded_box_pc_3000	-	cpe:2.3:h:dell:embedded_box_pc_3000:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "BIOS",
    "vendor": "Dell",
    "versions": [
      {
        "status": "affected",
        "version": "1.8"
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/000204685

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-32490