Lucene search

[email protected]NVD:CVE-2023-25537

HistoryMay 22, 2023 - 11:15 a.m.

CVE-2023-25537

2023-05-2211:15:09

CWE-787

[email protected]

web.nvd.nist.gov

dell poweredge

dell precision

bios

out of bounds write

vulnerability

smram

system management mode

code execution

privilege escalation

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability. A local attacker with low privileges could potentially exploit this vulnerability leading to exposure of some SMRAM stack/data/code in System Management Mode, leading to arbitrary code execution or escalation of privilege.

Affected configurations

Nvd

Node

dellpoweredge_r740_firmwareRange<2.18.1

AND

dellpoweredge_r740Match-

Node

dellpoweredge_r740xd_firmwareRange<2.18.1

AND

dellpoweredge_r740xdMatch-

Node

dellpoweredge_r640_firmwareRange<2.18.1

AND

dellpoweredge_r640Match-

Node

dellpoweredge_r940_firmwareRange<2.18.1

AND

dellpoweredge_r940Match-

Node

dellpoweredge_r540_firmwareRange<2.18.1

AND

dellpoweredge_r540Match-

Node

dellpoweredge_r440_firmwareRange<2.18.1

AND

dellpoweredge_r440Match-

Node

dellpoweredge_t440_firmwareRange<2.18.1

AND

dellpoweredge_t440Match-

Node

dellpoweredge_xr2_firmwareRange<2.18.1

AND

dellpoweredge_xr2Match-

Node

dellpoweredge_r740xd2_firmwareRange<2.18.1

AND

dellpoweredge_r740xd2Match-

Node

dellpoweredge_r840_firmwareRange<2.18.1

AND

dellpoweredge_r840Match-

Node

dellpoweredge_r940xa_firmwareRange<2.18.1

AND

dellpoweredge_r940xaMatch-

Node

dellpoweredge_t640_firmwareRange<2.18.1

AND

dellpoweredge_t640Match-

Node

dellpoweredge_c6420_firmwareRange<2.18.1

AND

dellpoweredge_c6420Match-

Node

dellpoweredge_fc640_firmwareRange<2.18.1

AND

dellpoweredge_fc640Match-

Node

dellpoweredge_m640_firmwareRange<2.18.1

AND

dellpoweredge_m640Match-

Node

dellpoweredge_mx740c_firmwareRange<2.18.1

AND

dellpoweredge_mx740cMatch-

Node

dellpoweredge_mx840c_firmwareRange<2.18.1

AND

dellpoweredge_mx840cMatch-

Node

dellpoweredge_c4140_firmwareRange<2.18.1

AND

dellpoweredge_c4140Match-

Node

delldss_8440_firmwareRange<2.18.1

AND

delldss_8440Match-

Node

dellpoweredge_xe2420_firmwareRange<2.18.1

AND

dellpoweredge_xe2420Match-

Node

dellpoweredge_xe7420_firmwareRange<2.18.1

AND

dellpoweredge_xe7420Match-

Node

dellpoweredge_xe7440_firmwareRange<2.18.1

AND

dellpoweredge_xe7440Match-

Node

dellemc_storage_nx3240_firmwareRange<2.18.1

AND

dellemc_storage_nx3240Match-

Node

dellemc_storage_nx3340_firmwareRange<2.18.1

AND

dellemc_storage_nx3340Match-

Node

dellemc_xc_core_6420_firmwareRange<2.18.1

AND

dellemc_xc_core_6420Match-

Node

dellemc_xc_core_xc640_firmwareRange<2.18.1

AND

dellemc_xc_core_xc640Match-

Node

dellemc_xc_core_xc740xd_firmwareRange<2.18.1

AND

dellemc_xc_core_xc740xdMatch-

Node

dellemc_xc_core_xc740xd2_firmwareRange<2.18.1

AND

dellemc_xc_core_xc740xd2Match-

Node

dellemc_xc_core_xc940_firmwareRange<2.18.1

AND

dellemc_xc_core_xc940Match-

Node

dellemc_xc_core_xcxr2_firmwareRange<2.18.1

AND

dellemc_xc_core_xcxr2Match-

VendorProductVersionCPE
dellpoweredge_r740_firmware*cpe:2.3:o:dell:poweredge_r740_firmware:*:*:*:*:*:*:*:*
dellpoweredge_r740-cpe:2.3:h:dell:poweredge_r740:-:*:*:*:*:*:*:*
dellpoweredge_r740xd_firmware*cpe:2.3:o:dell:poweredge_r740xd_firmware:*:*:*:*:*:*:*:*
dellpoweredge_r740xd-cpe:2.3:h:dell:poweredge_r740xd:-:*:*:*:*:*:*:*
dellpoweredge_r640_firmware*cpe:2.3:o:dell:poweredge_r640_firmware:*:*:*:*:*:*:*:*
dellpoweredge_r640-cpe:2.3:h:dell:poweredge_r640:-:*:*:*:*:*:*:*
dellpoweredge_r940_firmware*cpe:2.3:o:dell:poweredge_r940_firmware:*:*:*:*:*:*:*:*
dellpoweredge_r940-cpe:2.3:h:dell:poweredge_r940:-:*:*:*:*:*:*:*
dellpoweredge_r540_firmware*cpe:2.3:o:dell:poweredge_r540_firmware:*:*:*:*:*:*:*:*
dellpoweredge_r540-cpe:2.3:h:dell:poweredge_r540:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	poweredge_r740_firmware	*	cpe:2.3:o:dell:poweredge_r740_firmware::::::::
dell	poweredge_r740	-	cpe:2.3:h:dell:poweredge_r740:-:::::::*
dell	poweredge_r740xd_firmware	*	cpe:2.3:o:dell:poweredge_r740xd_firmware::::::::
dell	poweredge_r740xd	-	cpe:2.3:h:dell:poweredge_r740xd:-:::::::*
dell	poweredge_r640_firmware	*	cpe:2.3:o:dell:poweredge_r640_firmware::::::::
dell	poweredge_r640	-	cpe:2.3:h:dell:poweredge_r640:-:::::::*
dell	poweredge_r940_firmware	*	cpe:2.3:o:dell:poweredge_r940_firmware::::::::
dell	poweredge_r940	-	cpe:2.3:h:dell:poweredge_r940:-:::::::*
dell	poweredge_r540_firmware	*	cpe:2.3:o:dell:poweredge_r540_firmware::::::::
dell	poweredge_r540	-	cpe:2.3:h:dell:poweredge_r540:-:::::::*

Rows per page:

1-10 of 601

References

www.dell.com/support/kbdoc/en-us/000213550/dsa-2023-098-security-update-for-dell-poweredge-14g-server-bios-for-an-out-of-bounds-write-vulnerability

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for NVD:CVE-2023-25537

cvelist1 prion1 cve1