High severity · published Dec 8, 2023
CVE-2023-32460
Dell PowerEdge BIOS contains an improper privilege management security vulnerability
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Dell PowerEdge BIOS contains an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Poweredge C6420 Firmware · Dell
before 2.20.1 · source: NVD
PC
Poweredge C6520 Firmware · Dell
before 1.12.1 · source: NVD
PC
Poweredge C6525 Firmware · Dell
before 2.13.3 · source: NVD
PC
Poweredge C6615 Firmware · Dell
before 1.1.2 · source: NVD
PC
Poweredge C6620 Firmware · Dell
before 1.6.6 · source: NVD
PF
Poweredge Fc640 Firmware · Dell
before 2.20.1 · source: NVD
PH
Poweredge Hs5610 Firmware · Dell
before 1.6.6 · source: NVD
PH
Poweredge Hs5620 Firmware · Dell
before 1.6.6 · source: NVD
PM
Poweredge Mx750c Firmware · Dell
before 1.12.1 · source: NVD
PM
Poweredge Mx760c Firmware · Dell
before 1.6.6 · source: NVD
PR
Poweredge R250 Firmware · Dell
before 1.8.1 · source: NVD
PR
Poweredge R350 Firmware · Dell
before 1.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32460
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32460
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000219550/dsa-2023-361-security-update-for-dell-poweredge-server-bios-for-an-improper-privilege-management-security-vulnerability
More from Poweredge C6420 Firmware
8.4
CVE-2024-0161
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability
7.8
CVE-2023-25537
Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability
6.7
CVE-2021-21557
Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability
6.5
CVE-2024-38304
Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability
6.0
CVE-2024-38303
Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Improper Input Validation vulnerability