Medium severity · published Aug 9, 2022
CVE-2022-29083
Prior Dell BIOS versions contain an Improper Authentication vulnerability
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
Prior Dell BIOS versions contain an Improper Authentication vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability by bypassing drive security mechanisms in order to gain access to the system.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
CPG BIOS · Dell
before 9-12 · source: vendor
C3
Chengming 3980 Firmware · Dell
before 2.23.0 · source: NVD
C3
Chengming 3990 Firmware · Dell
before 1.11.0 · source: NVD
C3
Chengming 3991 Firmware · Dell
before 1.11.0 · source: NVD
G3
G3 3579 Firmware · Dell
before 1.21.0 · source: NVD
G3
G3 3779 Firmware · Dell
before 1.21.0 · source: NVD
G5
G5 5000 Firmware · Dell
before 1.7.0 · source: NVD
G5
G5 5090 Firmware · Dell
before 1.14.0 · source: NVD
G5
G5 5587 Firmware · Dell
before 1.21.0 · source: NVD
G7
G7 7588 Firmware · Dell
before 1.21.0 · source: NVD
I3
Inspiron 3470 Firmware · Dell
before 2.23.0 · source: NVD
I3
Inspiron 3480 Firmware · Dell
before 1.19.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29083
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29083
Vendor Advisory
https://www.dell.com/support/kbdoc/000201396
More from CPG BIOS
8.8
CVE-2022-32492
Dell BIOS contains an improper input validation vulnerability
8.8
CVE-2022-32486
Dell BIOS contains an improper input validation vulnerability
7.8
CVE-2022-34391
Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability
7.8
CVE-2022-34390
Dell BIOS contains a use of uninitialized variable vulnerability
7.8
CVE-2022-32493
Dell BIOS contains an Stack-Based Buffer Overflow vulnerability