High severity · published Aug 28, 2024
CVE-2023-43078
Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resulting in arbitrary folder deletion, which could lead to…
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resulting in arbitrary folder deletion, which could lead to Privilege Escalation or Denial of Service.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
Dell Client Platform, Dell Dock Firmware · Dell
before 1.27.0; before 1.22.0; before 1.14.1; before 1.11.0; before 1.19.0; before 1.20.0; +34 more · source: vendor
AM
Alienware M15 R6 Firmware · Dell
before 1.27.0 · source: NVD, CISA
AM
Alienware M15 R7 Firmware · Dell
before 1.22.0 · source: NVD, CISA
AM
Alienware M16 R1 Firmware · Dell
before 1.14.1 · source: NVD, CISA
AM
Alienware M18 R1 Firmware · Dell
before 1.14.1 · source: NVD
AX
Alienware X14 R2 Firmware · Dell
before 1.11.0 · source: NVD, CISA
AX
Alienware X16 R1 Firmware · Dell
before 1.11.0 · source: NVD
C3
Chengming 3900 Firmware · Dell
before 1.19.0 · source: NVD, CISA
C3
Chengming 3910 Firmware · Dell
before 1.11.0 · source: NVD
C3
Chengming 3911 Firmware · Dell
before 1.11.0 · source: NVD
C3
Chengming 3988 Firmware · Dell
before 1.20.0 · source: NVD, CISA
C3
Chengming 3990 Firmware · Dell
before 1.24.0 · source: NVD
Affected product
DC
Dell Client Platform, Dell Dock Firmware
Dell
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-43078
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-43078
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000217981/dsa-2023-362-security-update-for-dell-dock-firmware-and-dell-client-platform-for-an-improper-link-resolution-vulnerability