medium6.1
CVE-2023-25537
Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability.
Impact
Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability. A local attacker with low privileges could potentially exploit this vulnerability leading to exposure of some SMRAM stack/data/code in System Management Mode, leading to arbitrary code execution or escalation of privilege.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dell | Poweredge R740 Firmware | before 2.18.1 |
| Dell | Poweredge R740xd Firmware | before 2.18.1 |
| Dell | Poweredge R640 Firmware | before 2.18.1 |
| Dell | Poweredge R940 Firmware | before 2.18.1 |
| Dell | Poweredge R540 Firmware | before 2.18.1 |
| Dell | Poweredge R440 Firmware | before 2.18.1 |
| Dell | Poweredge T440 Firmware | before 2.18.1 |
| Dell | Poweredge Xr2 Firmware | before 2.18.1 |
| Dell | Poweredge R740xd2 Firmware | before 2.18.1 |
| Dell | Poweredge R840 Firmware | before 2.18.1 |
| Dell | Poweredge R940xa Firmware | before 2.18.1 |
| Dell | Poweredge T640 Firmware | before 2.18.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.dell.com/support/kbdoc/en-us/000213550/dsa-2023-098-security-update-for-dell-poweredge-14g-server-bios-for-an-out-of-bounds-write-vulnerability
- https://www.dell.com/support/kbdoc/en-us/000213550/dsa-2023-098-security-update-for-dell-poweredge-14g-server-bios-for-an-out-of-bounds-write-vulnerability