CVE-2022-24418 : Dell BIOS contains an improper input validation vulnerability. A local authentic

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.

Published 2022-05-26 16:15:08

Updated 2022-06-07 17:04:10

Source Dell

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2022-24418

Dell » Inspiron 5675 Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:inspiron_5675_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5675 » Version: N/A
Dell » Dell G5 5505 Firmware
Versions before (<) 1.10.0
cpe:2.3:o:dell:dell_g5_5505_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Dell G5 5505 » Version: N/A
Dell » Inspiron 22-3275 Firmware
Versions before (<) 1.8.0
cpe:2.3:o:dell:inspiron_22-3275_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 22-3275 » Version: N/A
Dell » Inspiron 24-3475 Firmware
Versions before (<) 1.8.0
cpe:2.3:o:dell:inspiron_24-3475_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 24-3475 » Version: N/A
Dell » Inspiron 27 7775 Firmware
Versions before (<) 2.15.0
cpe:2.3:o:dell:inspiron_27_7775_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 27 7775 » Version: N/A
Dell » Inspiron 3180 Firmware
Versions before (<) 1.4.4
cpe:2.3:o:dell:inspiron_3180_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3180 » Version: N/A
Dell » Inspiron 3185 Firmware
Versions before (<) 1.4.4
cpe:2.3:o:dell:inspiron_3185_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3185 » Version: N/A
Dell » Inspiron 3195 Firmware
Versions before (<) 1.4.1
cpe:2.3:o:dell:inspiron_3195_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3195 » Version: N/A
Dell » Inspiron 3505 Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:inspiron_3505_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3505 » Version: N/A
Dell » Inspiron 3515 Firmware
Versions before (<) 1.4.0
cpe:2.3:o:dell:inspiron_3515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3515 » Version: N/A
Dell » Inspiron 3585 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:inspiron_3585_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3585 » Version: N/A
Dell » Inspiron 3595 Firmware
Versions before (<) 1.2.1
cpe:2.3:o:dell:inspiron_3595_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3595 » Version: N/A
Dell » Inspiron 3785 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:inspiron_3785_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3785 » Version: N/A
Dell » Inspiron 5405 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:inspiron_5405_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5405 » Version: N/A
Dell » Inspiron 5415 Firmware
Versions before (<) 1.7.1
cpe:2.3:o:dell:inspiron_5415_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5415 » Version: N/A
Dell » Inspiron 5485 Firmware
Versions before (<) 2.7.0
cpe:2.3:o:dell:inspiron_5485_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5485 » Version: N/A
Dell » Inspiron 5505 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:inspiron_5505_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5505 » Version: N/A
Dell » Inspiron 5515 Firmware
Versions before (<) 1.7.1
cpe:2.3:o:dell:inspiron_5515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5515 » Version: N/A
Dell » Inspiron 5575 Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:inspiron_5575_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5575 » Version: N/A
Dell » Inspiron 5585 Firmware
Versions before (<) 2.7.0
cpe:2.3:o:dell:inspiron_5585_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5585 » Version: N/A
Dell » Inspiron 5775 Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:inspiron_5775_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5775 » Version: N/A
Dell » Inspiron 7375 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:inspiron_7375_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 7375 » Version: N/A
Dell » Inspiron 7405 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:inspiron_7405_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 7405 » Version: N/A
Dell » Inspiron 7415 Firmware
Versions before (<) 1.7.1
cpe:2.3:o:dell:inspiron_7415_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 7415 » Version: N/A
Dell » Vostro 3405 Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:vostro_3405_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3405 » Version: N/A
Dell » Vostro 3515 Firmware
Versions before (<) 1.4.0
cpe:2.3:o:dell:vostro_3515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3515 » Version: N/A
Dell » Vostro 5415 Firmware
Versions before (<) 1.7.1
cpe:2.3:o:dell:vostro_5415_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 5415 » Version: N/A
Dell » Vostro 5515 Firmware
Versions before (<) 1.7.1
cpe:2.3:o:dell:vostro_5515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 5515 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-24418

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-24418

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.5	HIGH	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	0.8	6.0	Dell
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-24418

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Assigned by:
- nvd@nist.gov (Primary)
- security_alert@emc.com (Secondary)

References for CVE-2022-24418

https://www.dell.com/support/kbdoc/en-us/000199285/dsa-2022-095

DSA-2022-095: Dell Client Platform Security Update for SMM Vulnerabilities | Dell Nederland
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-24418

Products affected by CVE-2022-24418

Exploit prediction scoring system (EPSS) score for CVE-2022-24418

CVSS scores for CVE-2022-24418

CWE ids for CVE-2022-24418

References for CVE-2022-24418