7.8

CVE-2023-25537

Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability. A local attacker with low privileges could potentially exploit this vulnerability leading to exposure of some SMRAM stack/data/code in System Management Mode, leading to arbitrary code execution or escalation of privilege.

Data is provided by the National Vulnerability Database (NVD)
Dell ≫ Poweredge R740 Firmware Version < 2.18.1
   Dell ≫ Poweredge R740 Version-
Dell ≫ Poweredge R740xd Firmware Version < 2.18.1
   Dell ≫ Poweredge R740xd Version-
Dell ≫ Poweredge R640 Firmware Version < 2.18.1
   Dell ≫ Poweredge R640 Version-
Dell ≫ Poweredge R940 Firmware Version < 2.18.1
   Dell ≫ Poweredge R940 Version-
Dell ≫ Poweredge R540 Firmware Version < 2.18.1
   Dell ≫ Poweredge R540 Version-
Dell ≫ Poweredge R440 Firmware Version < 2.18.1
   Dell ≫ Poweredge R440 Version-
Dell ≫ Poweredge T440 Firmware Version < 2.18.1
   Dell ≫ Poweredge T440 Version-
Dell ≫ Poweredge Xr2 Firmware Version < 2.18.1
   Dell ≫ Poweredge Xr2 Version-
Dell ≫ Poweredge R740xd2 Firmware Version < 2.18.1
   Dell ≫ Poweredge R740xd2 Version-
Dell ≫ Poweredge R840 Firmware Version < 2.18.1
   Dell ≫ Poweredge R840 Version-
Dell ≫ Poweredge R940xa Firmware Version < 2.18.1
   Dell ≫ Poweredge R940xa Version-
Dell ≫ Poweredge T640 Firmware Version < 2.18.1
   Dell ≫ Poweredge T640 Version-
Dell ≫ Poweredge C6420 Firmware Version < 2.18.1
   Dell ≫ Poweredge C6420 Version-
Dell ≫ Poweredge Fc640 Firmware Version < 2.18.1
   Dell ≫ Poweredge Fc640 Version-
Dell ≫ Poweredge M640 Firmware Version < 2.18.1
   Dell ≫ Poweredge M640 Version-
Dell ≫ Poweredge Mx740c Firmware Version < 2.18.1
   Dell ≫ Poweredge Mx740c Version-
Dell ≫ Poweredge Mx840c Firmware Version < 2.18.1
   Dell ≫ Poweredge Mx840c Version-
Dell ≫ Poweredge C4140 Firmware Version < 2.18.1
   Dell ≫ Poweredge C4140 Version-
Dell ≫ Dss 8440 Firmware Version < 2.18.1
   Dell ≫ Dss 8440 Version-
Dell ≫ Poweredge Xe2420 Firmware Version < 2.18.1
   Dell ≫ Poweredge Xe2420 Version-
Dell ≫ Poweredge Xe7420 Firmware Version < 2.18.1
   Dell ≫ Poweredge Xe7420 Version-
Dell ≫ Poweredge Xe7440 Firmware Version < 2.18.1
   Dell ≫ Poweredge Xe7440 Version-
Dell ≫ Emc Storage Nx3240 Firmware Version < 2.18.1
   Dell ≫ Emc Storage Nx3240 Version-
Dell ≫ Emc Storage Nx3340 Firmware Version < 2.18.1
   Dell ≫ Emc Storage Nx3340 Version-
Dell ≫ Emc Xc Core 6420 Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core 6420 Version-
Dell ≫ Emc Xc Core Xc640 Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core Xc640 Version-
Dell ≫ Emc Xc Core Xc740xd Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core Xc740xd Version-
Dell ≫ Emc Xc Core Xc740xd2 Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core Xc740xd2 Version-
Dell ≫ Emc Xc Core Xc940 Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core Xc940 Version-
Dell ≫ Emc Xc Core Xcxr2 Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core Xcxr2 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.03% 0.085
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security_alert@emc.com 6.1 1.8 4.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.