CVE-2023-39251: Dell BIOS contains an Improper Input Validation vulnerability

Medium severity · published Dec 22, 2023

CVE-2023-39251

Dell BIOS contains an Improper Input Validation vulnerability

6.7

CVSS

0.2%

EPSS

On KEV

Description

Dell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability in order to corrupt memory on the system.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 6% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CPG BIOS · Dell

Versions prior to 1.20.0; Versions prior to 1.23.0; Versions prior to 1.27.0; Versions prior to 1.25.0; Versions prior to 1.24.0 · source: vendor

Inspiron 7510 Firmware · Dell

before 1.20.0 · source: NVD

Inspiron 7610 Firmware · Dell

before 1.20.0 · source: NVD

Latitude 5430 Rugged Firmware · Dell

before 1.23.0 · source: NVD

Latitude 5521 Firmware · Dell

before 1.27.0 · source: NVD

Latitude 7330 Rugged Firmware · Dell

before 1.23.0 · source: NVD

Precision 3561 Firmware · Dell

before 1.27.0 · source: NVD

Precision 5560 Firmware · Dell

before 1.25.0 · source: NVD

Precision 5760 Firmware · Dell

before 1.24.0 · source: NVD

Precision 7560 Firmware · Dell

before 1.27.0 · source: NVD

Precision 7760 Firmware · Dell

before 1.27.0 · source: NVD

Vostro 7510 Firmware · Dell

before 1.20.0 · source: NVD

Affected product

CPG BIOS

Dell

All CPG BIOS CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-39251

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-39251

Vendor Advisory

https://www.dell.com/support/kbdoc/en-us/000217707/dsa-2023-342