CVE-2022-32482: Dell BIOS contains an improper input validation vulnerability

Medium severity · published Feb 1, 2023

CVE-2022-32482

Dell BIOS contains an improper input validation vulnerability

5.1

CVSS

0.2%

EPSS

On KEV

Description

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

Attack vector

Local

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

None

Integrity

High

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 5% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Alienware M15 R6 Firmware · Dell

before 1.17.0 · source: NVD

Alienware M15 R7 Firmware · Dell

before 1.10.0 · source: NVD

Chengming 3900 Firmware · Dell

before 1.7.3 · source: NVD

G15 5510 Firmware · Dell

before 1.16.0 · source: NVD

G15 5511 Firmware · Dell

before 1.18.0 · source: NVD

G15 5520 Firmware · Dell

before 1.10.0 · source: NVD

G16 7620 Firmware · Dell

before 1.12.0 · source: NVD

G3 3500 Firmware · Dell

before 1.20.0 · source: NVD

G5 15 5500 Firmware · Dell

before 1.20.0 · source: NVD

G7 15 7500 Firmware · Dell

before 1.19.0 · source: NVD

G7 17 7700 Firmware · Dell

before 1.19.0 · source: NVD

Inspiron 14 5410 2-in-1 Firmware · Dell

before 2.15.2 · source: NVD

Affected product

Alienware M15 R6 Firmware

Dell

All Alienware M15 R6 Firmware CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-32482

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-32482

Vendor Advisory

https://www.dell.com/support/kbdoc/en-us/000205717/dsa-2022-326