High severity · published Apr 3, 2024
CVE-2024-0172
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Poweredge C6520 Firmware · Dell
before 1.11.2 · source: NVD
PC
Poweredge C6525 Firmware · Dell
before 2.12.4 · source: NVD
PC
Poweredge C6620 Firmware · Dell
before 1.5.6 · source: NVD
PH
Poweredge Hs5610 Firmware · Dell
before 1.5.6 · source: NVD
PH
Poweredge Hs5620 Firmware · Dell
before 1.5.6 · source: NVD
PM
Poweredge Mx750c Firmware · Dell
before 1.11.2 · source: NVD
PM
Poweredge Mx760c Firmware · Dell
before 1.5.6 · source: NVD
PR
Poweredge R250 Firmware · Dell
before 1.7.3 · source: NVD
PR
Poweredge R350 Firmware · Dell
before 1.7.3 · source: NVD
PR
Poweredge R440 Firmware · Dell
before 2.19.1 · source: NVD
PR
Poweredge R450 Firmware · Dell
before 1.11.2 · source: NVD
PR
Poweredge R540 Firmware · Dell
before 2.19.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0172
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000223727/dsa-2024-035-security-update-for-dell-poweredge-server-bios-for-an-improper-privilege-management-security-vulnerability
More from Poweredge C6520 Firmware
8.8
CVE-2024-0162
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability
8.4
CVE-2024-0161
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability
7.8
CVE-2023-32460
Dell PowerEdge BIOS contains an improper privilege management security vulnerability
6.7
CVE-2023-32461
Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability
6.3
CVE-2024-0163
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability