Medium severity · published Jun 12, 2024
CVE-2024-0160
Dell Client Platform contains an incorrect authorization vulnerability
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
Dell Client Platform contains an incorrect authorization vulnerability. An attacker with physical access to the system could potentially exploit this vulnerability by bypassing BIOS authorization to modify settings in the BIOS.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
CPG BIOS · Dell
before 1.32.0 · source: vendor, CISA
G3
G3 3500 Firmware · Dell
before 1.30.0 · source: NVD
G5
G5 5500 Firmware · Dell
before 1.30.0 · source: NVD
G7
G7 7500 Firmware · Dell
before 1.32.0 · source: NVD
G7
G7 7700 Firmware · Dell
before 1.32.0 · source: NVD
I7
Inspiron 7500 Firmware · Dell
before 1.28.0 · source: NVD
I7
Inspiron 7501 Firmware · Dell
before 1.28.0 · source: NVD
L3
Latitude 3410 Firmware · Dell
before 1.29.0 · source: NVD
L3
Latitude 3420 Firmware · Dell
before 1.36.0 · source: NVD
L3
Latitude 3510 Firmware · Dell
before 1.29.0 · source: NVD
L3
Latitude 3520 Firmware · Dell
before 1.36.0 · source: NVD
P5
Precision 5550 Firmware · Dell
before 1.31.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0160
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000224763/dsa-2024-122
More from CPG BIOS
8.8
CVE-2022-32492
Dell BIOS contains an improper input validation vulnerability
8.8
CVE-2022-32486
Dell BIOS contains an improper input validation vulnerability
8.2
CVE-2024-32860
Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component
8.2
CVE-2024-32858
Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component
8.2
CVE-2024-32859
Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component