High-Severity Firmware Security Flaws Left Unpatched in HP Enterprise Devices

A number of firmware security flaws uncovered in HP's business-oriented high-end notebooks continue to be left unpatched in some devices even months after public disclosure. Binarly, which first revealed details of the issues at the Black Hat USA conference in mid-August 2022, said the...

CVE-2022-26861

Dell BIOS firmware contains an Insecure Automated Optimization vulnerability (CVE-2022-26861) that allows a locally authenticated attacker to trigger arbitrary code execution during System Management Mode (SMM) by sending malicious input via SMI. The issue is tied to the BIOS/SMM trust boundary, ...

CVE-2022-26861: Insecure Automated Optimizations

Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM...

CVE-2022-26859: Time-of-check Time-of-use (TOCTOU) Race Condition

Dell BIOS contains a race condition vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI in order to bypass security checks during SMM...

CVE-2022-26860: Stack-based Buffer Overflow

Dell BIOS versions contain a stack-based buffer overflow vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI to bypass security checks resulting in arbitrary code execution in SMM...

CVE-2022-34383: Improper Neutralization of Special Elements used in a Command

Dell Edge Gateway 5200 EGW versions before 1.03.10 contain an operating system command injection vulnerability. A local malicious user may potentially exploit this vulnerability by using an SMI to bypass PMC mitigation and gain arbitrary code execution during SMM...

HP PC BIOS August 2022 Security Updates for Potential SMM and TOCTOU Vulnerabilities

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate these potential vulnerabilities. HP has...

CVE-2022-31600

NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causing an integer overflow, possibly leading to code execution, escalation of privileges, denial of service, compromised integrity, and...

Dell BIOS Input Validation Error Vulnerability (CNVD-2022-85076)

Dell BIOS is embedded software on a small memory chip on a computer motherboard from Dell, U.S.A. An input validation error vulnerability exists in Dell BIOS, which can be exploited by a locally authenticated attacker to bypass security controls in SMM by sending malicious input to SMI...

Dell BIOS Input Validation Error Vulnerability (CNVD-2022-85078)

Dell BIOS is embedded software on a small memory chip on a computer motherboard from Dell, U.S.A. An input validation error vulnerability exists in Dell BIOS, which can be exploited by a locally authenticated attacker to bypass security controls in SMM by sending malicious input to SMI...

Dell BIOS Input Validation Error Vulnerability (CNVD-2022-85077)

Dell BIOS is embedded software on a small memory chip on a computer motherboard from Dell, U.S.A. An input validation error vulnerability exists in Dell BIOS, which can be exploited by a locally authenticated attacker to bypass security controls in SMM by sending malicious input to SMI...

CVE-2022-26862

Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM...

CVE-2022-26864

Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM...

CVE-2022-26863

Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM...

Input validation

Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM...

CVE-2022-26864

Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM...

CVE-2022-26864

The CVE-2022-26864 issue concerns Dell BIOS, where an input validation error in BIOS could be exploited by a locally authenticated attacker to bypass security controls in SMM by sending malicious input to an SMI. Multiple sources (NVD, CNVD, CNNVD, CVE records) describe the vulnerability as affec...

CVE-2022-26863

CVE-2022-26863 affects Dell BIOS (embedded BIOS on motherboard). The issue is an Input Validation vulnerability in Dell BIOS that can be exploited by a locally authenticated attacker who sends malicious input to an SMI to bypass security controls in SMM. Affected component: Dell BIOS firmware on ...

CVE-2022-26864: Improper Input Validation

Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM...

CVE-2022-26863: Improper Input Validation

Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM...