High severity · published Apr 3, 2024
CVE-2024-0172
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
PowerEdge Platform · Dell
before 1.5.6; before 1.1.3; before 1.1.4; before 1.2.5; before 1.3.6; before 1.4.6; +8 more · source: vendor
PC
Poweredge C6520 Firmware · Dell
before 1.11.2 · source: NVD, CISA
PC
Poweredge C6525 Firmware · Dell
before 2.12.4 · source: NVD, CISA
PC
Poweredge C6620 Firmware · Dell
before 1.5.6 · source: NVD, CISA
PH
Poweredge Hs5610 Firmware · Dell
before 1.5.6 · source: NVD, CISA
PH
Poweredge Hs5620 Firmware · Dell
before 1.5.6 · source: NVD, CISA
PM
Poweredge Mx750c Firmware · Dell
before 1.11.2 · source: NVD, CISA
PM
Poweredge Mx760c Firmware · Dell
before 1.5.6 · source: NVD, CISA
PR
Poweredge R250 Firmware · Dell
before 1.7.3 · source: NVD, CISA
PR
Poweredge R350 Firmware · Dell
before 1.7.3 · source: NVD, CISA
PR
Poweredge R440 Firmware · Dell
before 2.19.1 · source: NVD, CISA
PR
Poweredge R450 Firmware · Dell
before 1.11.2 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0172
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000223727/dsa-2024-035-security-update-for-dell-poweredge-server-bios-for-an-improper-privilege-management-security-vulnerability
More from PowerEdge Platform
8.4
CVE-2024-0161
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability
7.8
CVE-2023-32460
Dell PowerEdge BIOS contains an improper privilege management security vulnerability
7.8
CVE-2023-25537
Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability
6.8
CVE-2024-25942
Dell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability
6.7
CVE-2023-32461
Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability