CVE-2022-34393: Dell BIOS contains an improper input validation vulnerability

High severity · published Jan 18, 2023

CVE-2022-34393

Dell BIOS contains an improper input validation vulnerability

7.5

CVSS

0.2%

EPSS

On KEV

Description

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack vector

Local

Complexity

High

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 12% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

BIOS · Dell

through 2.17.0 · source: vendor

G5 SE 5505 Firmware · Dell

before 1.12.1 · source: NVD

Inspiron 27 7775 Firmware · Dell

before 2.17.0 · source: NVD

Inspiron 3180 Firmware · Dell

before 1.5.0 · source: NVD

Inspiron 3185 Firmware · Dell

before 1.5.0 · source: NVD

Inspiron 3195 2-in-1 Firmware · Dell

before 1.5.0 · source: NVD

Inspiron 3275 Firmware · Dell

before 1.9.1 · source: NVD

Inspiron 3475 Firmware · Dell

before 1.9.1 · source: NVD

Inspiron 3505 Firmware · Dell

before 1.8.0 · source: NVD

Inspiron 3515 Firmware · Dell

before 1.7.0 · source: NVD

Inspiron 3585 Firmware · Dell

before 1.9.0 · source: NVD

Inspiron 3595 Firmware · Dell

before 1.4.0 · source: NVD

Affected product

BIOS

Dell

All BIOS CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-34393

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-34393

Vendor Advisory

https://www.dell.com/support/kbdoc/000204686