CVE-2023-25537 : Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS

Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability. A local attacker with low privileges could potentially exploit this vulnerability leading to exposure of some SMRAM stack/data/code in System Management Mode, leading to arbitrary code execution or escalation of privilege.

Published 2023-05-22 11:15:09

Updated 2023-05-30 21:32:57

Source Dell

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Products affected by CVE-2023-25537

Dell » Poweredge R640 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_r640_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R640 » Version: N/A
Dell » Poweredge R740 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_r740_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R740 » Version: N/A
Dell » Poweredge R740xd Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_r740xd_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R740xd » Version: N/A
Dell » Poweredge R940 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_r940_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R940 » Version: N/A
Dell » Poweredge R540 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_r540_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R540 » Version: N/A
Dell » Poweredge R440 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_r440_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R440 » Version: N/A
Dell » Poweredge T440 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_t440_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge T440 » Version: N/A
Dell » Poweredge Xr2 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_xr2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xr2 » Version: N/A
Dell » Poweredge R740xd2 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_r740xd2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R740xd2 » Version: N/A
Dell » Poweredge R840 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_r840_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R840 » Version: N/A
Dell » Poweredge R940xa Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_r940xa_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R940xa » Version: N/A
Dell » Poweredge T640 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_t640_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge T640 » Version: N/A
Dell » Poweredge C6420 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_c6420_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge C6420 » Version: N/A
Dell » Poweredge Fc640 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_fc640_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Fc640 » Version: N/A
Dell » Poweredge M640 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_m640_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge M640 » Version: N/A
Dell » Poweredge Mx740c Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_mx740c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Mx740c » Version: N/A
Dell » Poweredge Mx840c Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_mx840c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Mx840c » Version: N/A
Dell » Poweredge C4140 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_c4140_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge C4140 » Version: N/A
Dell » Dss 8440 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:dss_8440_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Dss 8440 » Version: N/A
Dell » Poweredge Xe2420 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_xe2420_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xe2420 » Version: N/A
Dell » Poweredge Xe7420 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_xe7420_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xe7420 » Version: N/A
Dell » Poweredge Xe7440 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:poweredge_xe7440_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xe7440 » Version: N/A
Dell » Emc Storage Nx3240 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:emc_storage_nx3240_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Storage Nx3240 » Version: N/A
Dell » Emc Storage Nx3340 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:emc_storage_nx3340_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Storage Nx3340 » Version: N/A
Dell » Emc Xc Core 6420 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:emc_xc_core_6420_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core 6420 » Version: N/A
Dell » Emc Xc Core Xc640 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:emc_xc_core_xc640_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core Xc640 » Version: N/A
Dell » Emc Xc Core Xc740xd Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:emc_xc_core_xc740xd_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core Xc740xd » Version: N/A
Dell » Emc Xc Core Xc740xd2 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:emc_xc_core_xc740xd2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core Xc740xd2 » Version: N/A
Dell » Emc Xc Core Xc940 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:emc_xc_core_xc940_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core Xc940 » Version: N/A
Dell » Emc Xc Core Xcxr2 Firmware
Versions before (<) 2.18.1
cpe:2.3:o:dell:emc_xc_core_xcxr2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core Xcxr2 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-25537

EPSS FAQ

0.03%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 8 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-25537

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.1	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H	1.8	4.2	Dell
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: High

CWE ids for CVE-2023-25537

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: security_alert@emc.com (Primary)

References for CVE-2023-25537

https://www.dell.com/support/kbdoc/en-us/000213550/dsa-2023-098-security-update-for-dell-poweredge-14g-server-bios-for-an-out-of-bounds-write-vulnerability

Access Denied
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-25537

Products affected by CVE-2023-25537

Exploit prediction scoring system (EPSS) score for CVE-2023-25537

CVSS scores for CVE-2023-25537

CWE ids for CVE-2023-25537

References for CVE-2023-25537