VulnerabilityAnalyzed
CVE-2024-0172
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability.
HIGH 7.8EPSS 0.15%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.15% probability · 4th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-269
- Affected
- dell/poweredge r660 firmware · dell/poweredge r760 firmware · dell/poweredge c6620 firmware · dell/poweredge mx760c firmware · dell/poweredge r860 firmware · dell/poweredge r960 firmware · dell/poweredge hs5610 firmware · dell/poweredge hs5620 firmware · dell/poweredge r660xs firmware · dell/poweredge r760xs firmware · dell/poweredge r760xd2 firmware · dell/poweredge t560 firmware · dell/poweredge r760xa firmware · dell/poweredge xe9680 firmware · dell/poweredge xr5610 firmware · dell/poweredge xr8610t firmware · dell/poweredge xr8620t firmware · dell/poweredge xr7620 firmware · dell/poweredge xe8640 firmware · dell/poweredge xe9640 firmware · +40 more
- Source
- security_alert@emc.com
References
- https://www.dell.com/support/kbdoc/en-us/000223727/dsa-2024-035-security-update-for-dell-poweredge-server-bios-for-an-improper-privilege-management-security-vulnerabilityVendor Advisory
- https://www.dell.com/support/kbdoc/en-us/000223727/dsa-2024-035-security-update-for-dell-poweredge-server-bios-for-an-improper-privilege-management-security-vulnerabilityVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.