CVE-2023-25537
Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability. A local attacker with low privileges could potentially exploit this vulnerability leading to exposure of some SMRAM stack/data/code in System Management Mode, leading to arbitrary code execution or escalation of privilege.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.18% probability · 8th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- dell/poweredge r740 firmware · dell/poweredge r740xd firmware · dell/poweredge r640 firmware · dell/poweredge r940 firmware · dell/poweredge r540 firmware · dell/poweredge r440 firmware · dell/poweredge t440 firmware · dell/poweredge xr2 firmware · dell/poweredge r740xd2 firmware · dell/poweredge r840 firmware · dell/poweredge r940xa firmware · dell/poweredge t640 firmware · dell/poweredge c6420 firmware · dell/poweredge fc640 firmware · dell/poweredge m640 firmware · dell/poweredge mx740c firmware · dell/poweredge mx840c firmware · dell/poweredge c4140 firmware · dell/dss 8440 firmware · dell/poweredge xe2420 firmware · +10 more
- Source
- security_alert@emc.com
References
- https://www.dell.com/support/kbdoc/en-us/000213550/dsa-2023-098-security-update-for-dell-poweredge-14g-server-bios-for-an-out-of-bounds-write-vulnerabilityVendor Advisory
- https://www.dell.com/support/kbdoc/en-us/000213550/dsa-2023-098-security-update-for-dell-poweredge-14g-server-bios-for-an-out-of-bounds-write-vulnerabilityVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.