7.8

CVE-2023-25537

Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability. A local attacker with low privileges could potentially exploit this vulnerability leading to exposure of some SMRAM stack/data/code in System Management Mode, leading to arbitrary code execution or escalation of privilege.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dell ≫ Poweredge R740 Firmware Version < 2.18.1
   Dell ≫ Poweredge R740 Version -
Dell ≫ Poweredge R740xd Firmware Version < 2.18.1
   Dell ≫ Poweredge R740xd Version -
Dell ≫ Poweredge R640 Firmware Version < 2.18.1
   Dell ≫ Poweredge R640 Version -
Dell ≫ Poweredge R940 Firmware Version < 2.18.1
   Dell ≫ Poweredge R940 Version -
Dell ≫ Poweredge R540 Firmware Version < 2.18.1
   Dell ≫ Poweredge R540 Version -
Dell ≫ Poweredge R440 Firmware Version < 2.18.1
   Dell ≫ Poweredge R440 Version -
Dell ≫ Poweredge T440 Firmware Version < 2.18.1
   Dell ≫ Poweredge T440 Version -
Dell ≫ Poweredge Xr2 Firmware Version < 2.18.1
   Dell ≫ Poweredge Xr2 Version -
Dell ≫ Poweredge R740xd2 Firmware Version < 2.18.1
   Dell ≫ Poweredge R740xd2 Version -
Dell ≫ Poweredge R840 Firmware Version < 2.18.1
   Dell ≫ Poweredge R840 Version -
Dell ≫ Poweredge R940xa Firmware Version < 2.18.1
   Dell ≫ Poweredge R940xa Version -
Dell ≫ Poweredge T640 Firmware Version < 2.18.1
   Dell ≫ Poweredge T640 Version -
Dell ≫ Poweredge C6420 Firmware Version < 2.18.1
   Dell ≫ Poweredge C6420 Version -
Dell ≫ Poweredge Fc640 Firmware Version < 2.18.1
   Dell ≫ Poweredge Fc640 Version -
Dell ≫ Poweredge M640 Firmware Version < 2.18.1
   Dell ≫ Poweredge M640 Version -
Dell ≫ Poweredge Mx740c Firmware Version < 2.18.1
   Dell ≫ Poweredge Mx740c Version -
Dell ≫ Poweredge Mx840c Firmware Version < 2.18.1
   Dell ≫ Poweredge Mx840c Version -
Dell ≫ Poweredge C4140 Firmware Version < 2.18.1
   Dell ≫ Poweredge C4140 Version -
Dell ≫ Dss 8440 Firmware Version < 2.18.1
   Dell ≫ Dss 8440 Version -
Dell ≫ Poweredge Xe2420 Firmware Version < 2.18.1
   Dell ≫ Poweredge Xe2420 Version -
Dell ≫ Poweredge Xe7420 Firmware Version < 2.18.1
   Dell ≫ Poweredge Xe7420 Version -
Dell ≫ Poweredge Xe7440 Firmware Version < 2.18.1
   Dell ≫ Poweredge Xe7440 Version -
Dell ≫ Emc Storage Nx3240 Firmware Version < 2.18.1
   Dell ≫ Emc Storage Nx3240 Version -
Dell ≫ Emc Storage Nx3340 Firmware Version < 2.18.1
   Dell ≫ Emc Storage Nx3340 Version -
Dell ≫ Emc Xc Core 6420 Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core 6420 Version -
Dell ≫ Emc Xc Core Xc640 Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core Xc640 Version -
Dell ≫ Emc Xc Core Xc740xd Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core Xc740xd Version -
Dell ≫ Emc Xc Core Xc740xd2 Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core Xc740xd2 Version -
Dell ≫ Emc Xc Core Xc940 Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core Xc940 Version -
Dell ≫ Emc Xc Core Xcxr2 Firmware Version < 2.18.1
   Dell ≫ Emc Xc Core Xcxr2 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.076
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EMC 6.1 1.8 4.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://www.dell.com/support/kbdoc/en-us/000213550/dsa-2023-098-security-update-for-dell-poweredge-14g-server-bios-for-an-out-of-bounds-write-vulnerability
Vendor Advisory