CVE-2022-31221: Dell BIOS versions contain an Information Exposure vulnerability

Low severity · published Sep 12, 2022

CVE-2022-31221

Dell BIOS versions contain an Information Exposure vulnerability

2.3

CVSS

0.2%

EPSS

On KEV

Description

Dell BIOS versions contain an Information Exposure vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in order access sensitive state information on the system.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack vector

Local

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 8% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CPG BIOS · Dell

before 21Q4 platforms · source: vendor

Chengming 3900 Firmware · Dell

before 1.1.66 · source: NVD

Inspiron 14 Plus 7420 Firmware · Dell

before 1.2.0 · source: NVD

Inspiron 16 Plus 7620 Firmware · Dell

before 1.2.0 · source: NVD

Inspiron 3910 Firmware · Dell

before 1.1.66 · source: NVD

Inspiron 5320 Firmware · Dell

before 1.1.0 · source: NVD

Inspiron 5420 Firmware · Dell

before 1.4.1 · source: NVD

Inspiron 5620 Firmware · Dell

before 1.4.1 · source: NVD

Inspiron 7420 Firmware · Dell

before 1.3.0 · source: NVD

Inspiron 7620 Firmware · Dell

before 1.3.0 · source: NVD

Optiplex 3000 Firmware · Dell

before 1.1.66 · source: NVD

Optiplex 3000 Thin Client Firmware · Dell

before 1.0.7 · source: NVD

Affected product

CPG BIOS

Dell

All CPG BIOS CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-31221

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-31221

Patch

https://www.dell.com/support/kbdoc/000202196