CVE-2022-26863 : Prior Dell BIOS versions contain an Input Validation vulnerability. A locally au

Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.

Published 2022-06-23 18:15:08

Updated 2022-06-30 17:47:04

Source Dell

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2022-26863

Dell » Inspiron 27 7775 Firmware
Versions before (<) 2.16.1
cpe:2.3:o:dell:inspiron_27_7775_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 27 7775 » Version: N/A
Dell » Inspiron 3180 Firmware
Versions before (<) 1.4.4
cpe:2.3:o:dell:inspiron_3180_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3180 » Version: N/A
Dell » Inspiron 3185 Firmware
Versions before (<) 1.4.4
cpe:2.3:o:dell:inspiron_3185_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3185 » Version: N/A
Dell » Inspiron 3195 Firmware
Versions before (<) 1.4.1
cpe:2.3:o:dell:inspiron_3195_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3195 » Version: N/A
Dell » Inspiron 3505 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:inspiron_3505_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3505 » Version: N/A
Dell » Inspiron 3515 Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:inspiron_3515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3515 » Version: N/A
Dell » Inspiron 3585 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:inspiron_3585_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3585 » Version: N/A
Dell » Inspiron 3595 Firmware
Versions before (<) 1.3.0
cpe:2.3:o:dell:inspiron_3595_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3595 » Version: N/A
Dell » Inspiron 3785 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:inspiron_3785_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3785 » Version: N/A
Dell » Inspiron 5405 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:inspiron_5405_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5405 » Version: N/A
Dell » Inspiron 5415 Firmware
Versions before (<) 1.9.0
cpe:2.3:o:dell:inspiron_5415_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5415 » Version: N/A
Dell » Inspiron 5485 Firmware
Versions before (<) 2.8.0
cpe:2.3:o:dell:inspiron_5485_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5485 » Version: N/A
Dell » Inspiron 5505 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:inspiron_5505_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5505 » Version: N/A
Dell » Inspiron 5515 Firmware
Versions before (<) 1.9.0
cpe:2.3:o:dell:inspiron_5515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5515 » Version: N/A
Dell » Inspiron 5575 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:inspiron_5575_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5575 » Version: N/A
Dell » Inspiron 5585 Firmware
Versions before (<) 2.8.0
cpe:2.3:o:dell:inspiron_5585_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5585 » Version: N/A
Dell » Inspiron 7375 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:inspiron_7375_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 7375 » Version: N/A
Dell » Inspiron 7405 Firmware
Versions before (<) 1.8.0
cpe:2.3:o:dell:inspiron_7405_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 7405 » Version: N/A
Dell » Inspiron 7415 Firmware
Versions before (<) 1.9.0
cpe:2.3:o:dell:inspiron_7415_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 7415 » Version: N/A
Dell » Vostro 3405 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:vostro_3405_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3405 » Version: N/A
Dell » Vostro 3515 Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:vostro_3515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3515 » Version: N/A
Dell » Vostro 5415 Firmware
Versions before (<) 1.9.0
cpe:2.3:o:dell:vostro_5415_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 5415 » Version: N/A
Dell » Vostro 5515 Firmware
Versions before (<) 1.9.0
cpe:2.3:o:dell:vostro_5515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 5515 » Version: N/A
Dell » Alienware M15 R5 Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:alienware_m15_r5_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware M15 R5 » Version: N/A
Dell » G15 5515 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:g15_5515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » G15 5515 » Version: N/A
Dell » G5 Se 5505 Firmware
Versions before (<) 1.11.0
cpe:2.3:o:dell:g5_se_5505_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » G5 Se 5505 » Version: N/A
Dell » Inspiron 14 5425 Firmware
Versions before (<) 1.2.1
cpe:2.3:o:dell:inspiron_14_5425_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 14 5425 » Version: N/A
Dell » Inspiron 3275 Firmware
Versions before (<) 1.9.0
cpe:2.3:o:dell:inspiron_3275_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3275 » Version: N/A
Dell » Inspiron 3475 Firmware
Versions before (<) 1.9.0
cpe:2.3:o:dell:inspiron_3475_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3475 » Version: N/A
Dell » Inspiron 3525 Firmware
Versions before (<) 1.3.0
cpe:2.3:o:dell:inspiron_3525_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3525 » Version: N/A
Dell » Inspiron 5415 All-in-one Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:inspiron_5415_all-in-one_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5415 All-in-one » Version: N/A
Dell » Inspiron 7425 Firmware
Versions before (<) 1.2.1
cpe:2.3:o:dell:inspiron_7425_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 7425 » Version: N/A
Dell » Vostro 3525 Firmware
Versions before (<) 1.3.0
cpe:2.3:o:dell:vostro_3525_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3525 » Version: N/A
Dell » Vostro 5625 Firmware
Versions before (<) 1.2.1
cpe:2.3:o:dell:vostro_5625_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 5625 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-26863

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-26863

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.3	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L	0.8	5.5	Dell
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: Low

CWE ids for CVE-2022-26863

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Assigned by:
- nvd@nist.gov (Primary)
- security_alert@emc.com (Secondary)

References for CVE-2022-26863

https://www.dell.com/support/kbdoc/en-us/000200568/dsa-2022-096

Access Denied
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-26863

Products affected by CVE-2022-26863

Exploit prediction scoring system (EPSS) score for CVE-2022-26863

CVSS scores for CVE-2022-26863

CWE ids for CVE-2022-26863

References for CVE-2022-26863