CVE-2023-32461 : Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerabil

Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability, leading to corrupt memory and potentially escalate privileges.

Published 2023-09-15 07:15:10

Updated 2023-09-20 16:49:51

Source Dell

View at NVD, CVE.org

Vulnerability category: Overflow

Products affected by CVE-2023-32461

Dell » Poweredge R6515 Firmware
Versions before (<) 2.11.4
cpe:2.3:o:dell:poweredge_r6515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R6515 » Version: N/A
Dell » Poweredge R7515 Firmware
Versions before (<) 2.11.4
cpe:2.3:o:dell:poweredge_r7515_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R7515 » Version: N/A
Dell » Poweredge R6525 Firmware
Versions before (<) 2.11.3
cpe:2.3:o:dell:poweredge_r6525_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R6525 » Version: N/A
Dell » Poweredge R7525 Firmware
Versions before (<) 2.11.3
cpe:2.3:o:dell:poweredge_r7525_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R7525 » Version: N/A
Dell » Poweredge C6525 Firmware
Versions before (<) 2.11.3
cpe:2.3:o:dell:poweredge_c6525_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge C6525 » Version: N/A
Dell » Poweredge R660 Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_r660_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R660 » Version: N/A
Dell » Poweredge R760 Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_r760_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R760 » Version: N/A
Dell » Poweredge C6620 Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_c6620_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge C6620 » Version: N/A
Dell » Poweredge Mx760c Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_mx760c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Mx760c » Version: N/A
Dell » Poweredge R860 Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_r860_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R860 » Version: N/A
Dell » Poweredge R960 Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_r960_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R960 » Version: N/A
Dell » Poweredge Hs5610 Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_hs5610_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Hs5610 » Version: N/A
Dell » Poweredge Hs5620 Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_hs5620_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Hs5620 » Version: N/A
Dell » Poweredge R660xs Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_r660xs_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R660xs » Version: N/A
Dell » Poweredge R760xs Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_r760xs_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R760xs » Version: N/A
Dell » Poweredge R760xd2 Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_r760xd2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R760xd2 » Version: N/A
Dell » Poweredge T560 Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_t560_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge T560 » Version: N/A
Dell » Poweredge R760xa Firmware
Versions before (<) 1.1.3
cpe:2.3:o:dell:poweredge_r760xa_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R760xa » Version: N/A
Dell » Poweredge Xe9680 Firmware
Versions before (<) 1.1.3
cpe:2.3:o:dell:poweredge_xe9680_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xe9680 » Version: N/A
Dell » Poweredge Xr5610 Firmware
Versions before (<) 1.1.4
cpe:2.3:o:dell:poweredge_xr5610_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xr5610 » Version: N/A
Dell » Poweredge Xr8620t Firmware
Versions before (<) 1.1.3
cpe:2.3:o:dell:poweredge_xr8620t_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xr8620t » Version: N/A
Dell » Poweredge Xr7620 Firmware
Versions before (<) 1.5.6
cpe:2.3:o:dell:poweredge_xr7620_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xr7620 » Version: N/A
Dell » Poweredge Xe8640 Firmware
Versions before (<) 1.2.5
cpe:2.3:o:dell:poweredge_xe8640_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xe8640 » Version: N/A
Dell » Poweredge R6615 Firmware
Versions before (<) 1.3.11
cpe:2.3:o:dell:poweredge_r6615_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R6615 » Version: N/A
Dell » Poweredge R7615 Firmware
Versions before (<) 1.3.11
cpe:2.3:o:dell:poweredge_r7615_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R7615 » Version: N/A
Dell » Poweredge R6625 Firmware
Versions before (<) 1.3.11
cpe:2.3:o:dell:poweredge_r6625_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R6625 » Version: N/A
Dell » Poweredge R7625 Firmware
Versions before (<) 1.3.11
cpe:2.3:o:dell:poweredge_r7625_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R7625 » Version: N/A
Dell » Poweredge R650 Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_r650_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R650 » Version: N/A
Dell » Poweredge R750 Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_r750_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R750 » Version: N/A
Dell » Poweredge R750xa Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_r750xa_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R750xa » Version: N/A
Dell » Poweredge C6520 Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_c6520_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge C6520 » Version: N/A
Dell » Poweredge Mx750c Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_mx750c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Mx750c » Version: N/A
Dell » Poweredge R550 Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_r550_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R550 » Version: N/A
Dell » Poweredge R450 Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_r450_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R450 » Version: N/A
Dell » Poweredge R650xs Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_r650xs_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R650xs » Version: N/A
Dell » Poweredge R750xs Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_r750xs_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R750xs » Version: N/A
Dell » Poweredge T550 Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_t550_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge T550 » Version: N/A
Dell » Poweredge Xr11 Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_xr11_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xr11 » Version: N/A
Dell » Poweredge Xr12 Firmware
Versions before (<) 1.10.2
cpe:2.3:o:dell:poweredge_xr12_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xr12 » Version: N/A
Dell » Poweredge T150 Firmware
Versions before (<) 1.6.3
cpe:2.3:o:dell:poweredge_t150_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge T150 » Version: N/A
Dell » Poweredge T350 Firmware
Versions before (<) 1.6.3
cpe:2.3:o:dell:poweredge_t350_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge T350 » Version: N/A
Dell » Poweredge R250 Firmware
Versions before (<) 1.6.3
cpe:2.3:o:dell:poweredge_r250_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R250 » Version: N/A
Dell » Poweredge R350 Firmware
Versions before (<) 1.6.3
cpe:2.3:o:dell:poweredge_r350_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge R350 » Version: N/A
Dell » Poweredge Xr4510c Firmware
Versions before (<) 1.10.4
cpe:2.3:o:dell:poweredge_xr4510c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xr4510c » Version: N/A
Dell » Poweredge Xr4520c Firmware
Versions before (<) 1.10.4
cpe:2.3:o:dell:poweredge_xr4520c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xr4520c » Version: N/A
Dell » Poweredge Xr4520c Firmware » Version: 1.10.4
cpe:2.3:o:dell:poweredge_xr4520c_firmware:1.10.4:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xr4520c » Version: N/A
Dell » Poweredge Xe8545 Firmware
Versions before (<) 2.11.3
cpe:2.3:o:dell:poweredge_xe8545_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Poweredge Xe8545 » Version: N/A
Dell » Emc Xc Core Xc450 Firmware
Versions before (<) 1.11.2
cpe:2.3:o:dell:emc_xc_core_xc450_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core Xc450 » Version: N/A
Dell » Emc Xc Core Xc650 Firmware
Versions before (<) 1.11.2
cpe:2.3:o:dell:emc_xc_core_xc650_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core Xc650 » Version: N/A
Dell » Emc Xc Core Xc750 Firmware
Versions before (<) 1.11.2
cpe:2.3:o:dell:emc_xc_core_xc750_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core Xc750 » Version: N/A
Dell » Emc Xc Core Xc750xa Firmware
Versions before (<) 1.11.2
cpe:2.3:o:dell:emc_xc_core_xc750xa_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core Xc750xa » Version: N/A
Dell » Emc Xc Core Xc6520 Firmware
Versions before (<) 1.11.2
cpe:2.3:o:dell:emc_xc_core_xc6520_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core Xc6520 » Version: N/A
Dell » Emc Xc Core Xc7525 Firmware
Versions before (<) 2.11.3
cpe:2.3:o:dell:emc_xc_core_xc7525_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Xc Core Xc7525 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-32461

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 21 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-32461

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
5.0	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L	0.8	3.7	Dell
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: None Scope: Changed Confidentiality: Low Integrity: Low Availability: Low

CWE ids for CVE-2023-32461

CWE-122 Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Assigned by: security_alert@emc.com (Primary)

References for CVE-2023-32461

https://www.dell.com/support/kbdoc/en-us/000216543/dsa-2023-292-security-update-for-dell-poweredge-server-bios-vulnerability

DSA-2023-292: Security Update for Dell PowerEdge Server BIOS Vulnerability | Dell US
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-32461

Products affected by CVE-2023-32461

Exploit prediction scoring system (EPSS) score for CVE-2023-32461

CVSS scores for CVE-2023-32461

CWE ids for CVE-2023-32461

References for CVE-2023-32461