CVE-2022-34393 : Dell BIOS contains an improper input validation vulnerability. A local authentic

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

Published 2023-01-18 06:15:11

Updated 2023-01-25 19:27:53

Source Dell

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2022-34393

Dell » Inspiron 27 7775 Firmware
Versions before (<) 2.17.0
cpe:2.3:o:dell:inspiron_27_7775_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 27 7775 » Version: N/A
Dell » Inspiron 3180 Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:inspiron_3180_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3180 » Version: N/A
Dell » Inspiron 3185 Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:inspiron_3185_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3185 » Version: N/A
Dell » Inspiron 3505 Firmware
Versions before (<) 1.8.0
cpe:2.3:o:dell:inspiron_3505_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3505 » Version: N/A
Dell » Inspiron 3515 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:inspiron_3515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3515 » Version: N/A
Dell » Inspiron 3585 Firmware
Versions before (<) 1.9.0
cpe:2.3:o:dell:inspiron_3585_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3585 » Version: N/A
Dell » Inspiron 3595 Firmware
Versions before (<) 1.4.0
cpe:2.3:o:dell:inspiron_3595_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3595 » Version: N/A
Dell » Inspiron 3785 Firmware
Versions before (<) 1.9.0
cpe:2.3:o:dell:inspiron_3785_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3785 » Version: N/A
Dell » Inspiron 5405 Firmware
Versions before (<) 1.8.1
cpe:2.3:o:dell:inspiron_5405_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5405 » Version: N/A
Dell » Inspiron 5415 Firmware
Versions before (<) 1.12.0
cpe:2.3:o:dell:inspiron_5415_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5415 » Version: N/A
Dell » Inspiron 5485 Firmware
Versions before (<) 2.10.1
cpe:2.3:o:dell:inspiron_5485_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5485 » Version: N/A
Dell » Inspiron 5505 Firmware
Versions before (<) 1.8.1
cpe:2.3:o:dell:inspiron_5505_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5505 » Version: N/A
Dell » Inspiron 5515 Firmware
Versions before (<) 1.12.0
cpe:2.3:o:dell:inspiron_5515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5515 » Version: N/A
Dell » Inspiron 5585 Firmware
Versions before (<) 2.10.1
cpe:2.3:o:dell:inspiron_5585_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5585 » Version: N/A
Dell » Inspiron 7375 Firmware
Versions before (<) 1.9.0
cpe:2.3:o:dell:inspiron_7375_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 7375 » Version: N/A
Dell » Inspiron 7415 Firmware
Versions before (<) 1.12.0
cpe:2.3:o:dell:inspiron_7415_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 7415 » Version: N/A
Dell » Vostro 3405 Firmware
Versions before (<) 1.8.0
cpe:2.3:o:dell:vostro_3405_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3405 » Version: N/A
Dell » Vostro 3515 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:vostro_3515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3515 » Version: N/A
Dell » Vostro 5415 Firmware
Versions before (<) 1.12.0
cpe:2.3:o:dell:vostro_5415_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 5415 » Version: N/A
Dell » Vostro 5515 Firmware
Versions before (<) 1.12.0
cpe:2.3:o:dell:vostro_5515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 5515 » Version: N/A
Dell » G5 Se 5505 Firmware
Versions before (<) 1.12.1
cpe:2.3:o:dell:g5_se_5505_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » G5 Se 5505 » Version: N/A
Dell » Inspiron 3275 Firmware
Versions before (<) 1.9.1
cpe:2.3:o:dell:inspiron_3275_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3275 » Version: N/A
Dell » Inspiron 3475 Firmware
Versions before (<) 1.9.1
cpe:2.3:o:dell:inspiron_3475_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3475 » Version: N/A
Dell » Inspiron 3195 2-in-1 Firmware
Versions before (<) 1.5.0
cpe:2.3:o:dell:inspiron_3195_2-in-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3195 2-in-1 » Version: N/A
Dell » Inspiron 5485 2-in-1 Firmware
Versions before (<) 2.10.1
cpe:2.3:o:dell:inspiron_5485_2-in-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 5485 2-in-1 » Version: N/A
Dell » Inspiron 7405 2-in-1 Firmware
Versions before (<) 1.9.1
cpe:2.3:o:dell:inspiron_7405_2-in-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 7405 2-in-1 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-34393

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-34393

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	0.8	6.0	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
7.5	HIGH	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	0.8	6.0	Dell
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-34393

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Assigned by:
- nvd@nist.gov (Primary)
- security_alert@emc.com (Secondary)

References for CVE-2022-34393

https://www.dell.com/support/kbdoc/000204686

Access Denied
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-34393

Products affected by CVE-2022-34393

Exploit prediction scoring system (EPSS) score for CVE-2022-34393

CVSS scores for CVE-2022-34393

CWE ids for CVE-2022-34393

References for CVE-2022-34393