Medium severity · published Jun 12, 2024
CVE-2024-0160
Dell Client Platform contains an incorrect authorization vulnerability
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
Dell Client Platform contains an incorrect authorization vulnerability. An attacker with physical access to the system could potentially exploit this vulnerability by bypassing BIOS authorization to modify settings in the BIOS.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
G3
G3 3500 Firmware · Dell
before 1.30.0 · source: NVD
G5
G5 5500 Firmware · Dell
before 1.30.0 · source: NVD
G7
G7 7500 Firmware · Dell
before 1.32.0 · source: NVD
G7
G7 7700 Firmware · Dell
before 1.32.0 · source: NVD
I7
Inspiron 7500 Firmware · Dell
before 1.28.0 · source: NVD
I7
Inspiron 7501 Firmware · Dell
before 1.28.0 · source: NVD
L3
Latitude 3410 Firmware · Dell
before 1.29.0 · source: NVD
L3
Latitude 3420 Firmware · Dell
before 1.36.0 · source: NVD
L3
Latitude 3510 Firmware · Dell
before 1.29.0 · source: NVD
L3
Latitude 3520 Firmware · Dell
before 1.36.0 · source: NVD
P5
Precision 5550 Firmware · Dell
before 1.31.0 · source: NVD
P5
Precision 5750 Firmware · Dell
before 1.30.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0160
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000224763/dsa-2024-122
More from G3 3500 Firmware
7.8
CVE-2022-26861
Dell BIOS versions contain an Insecure Automated Optimization vulnerability
7.8
CVE-2022-26860
Dell BIOS versions contain a stack-based buffer overflow vulnerability
7.8
CVE-2022-26858
Dell BIOS versions contain an Improper Authentication vulnerability
7.5
CVE-2021-21574
Dell BIOSConnect feature contains a buffer overflow vulnerability
7.5
CVE-2021-21573
Dell BIOSConnect feature contains a buffer overflow vulnerability