CVE-2023-48674: Dell Platform BIOS contains an Improper Null Termination vulnerability

Medium severity · published Mar 1, 2024

CVE-2023-48674

Dell Platform BIOS contains an Improper Null Termination vulnerability

4.9

CVSS

0.5%

EPSS

On KEV

Description

Dell Platform BIOS contains an Improper Null Termination vulnerability. A high privilege user with network access to the system could potentially send malicious data to the device in order to cause some services to cease to function.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 42% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Latitude 5280 Firmware · Dell

before 1.34.0 · source: NVD

Latitude 5288 Firmware · Dell

before 1.34.0 · source: NVD

Latitude 5290 2-in-1 Firmware · Dell

before 1.32.0 · source: NVD

Latitude 5290 Firmware · Dell

before 1.33.0 · source: NVD

Latitude 5300 2-in-1 Firmware · Dell

before 1.29.0 · source: NVD

Latitude 5300 Firmware · Dell

before 1.29.0 · source: NVD

Latitude 5310 2-in-1 Firmware · Dell

before 1.22.0 · source: NVD

Latitude 5310 Firmware · Dell

before 1.22.0 · source: NVD

Latitude 5320 Firmware · Dell

before 1.36.0 · source: NVD

Latitude 5330 Firmware · Dell

before 1.19.0 · source: NVD

Latitude 5340 Firmware · Dell

before 1.10.1 · source: NVD

Latitude 5400 Firmware · Dell

before 1.28.0 · source: NVD

Affected product

Latitude 5280 Firmware

Dell

All Latitude 5280 Firmware CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-48674

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-48674

Vendor Advisory

https://www.dell.com/support/kbdoc/en-us/000220410/dsa-2023-467