Medium severity · published Jun 12, 2024
CVE-2024-28970
Dell Client BIOS contains an Out-of-bounds Write vulnerability
4.4
CVSS
0.1%
EPSS
No
On KEV
Description
Dell Client BIOS contains an Out-of-bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to platform denial of service.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
G7
G7 7500 Firmware · Dell
before 1.32.0 · source: NVD
G7
G7 7700 Firmware · Dell
before 1.32.0 · source: NVD
I1
Inspiron 14 Plus 7440 Firmware · Dell
before 1.6.0 · source: NVD
I1
Inspiron 16 7640 2-in-1 Firmware · Dell
before 1.4.0 · source: NVD
I1
Inspiron 16 Plus 7640 Firmware · Dell
before 1.6.0 · source: NVD
I2
Inspiron 24 5420 All-in-one Firmware · Dell
before 1.11.0 · source: NVD
I2
Inspiron 27 7720 All-in-one Firmware · Dell
before 1.11.0 · source: NVD
I5
Inspiron 5402 Firmware · Dell
before 1.30.0 · source: NVD
I5
Inspiron 5409 Firmware · Dell
before 1.30.0 · source: NVD
I5
Inspiron 5502 Firmware · Dell
before 1.30.0 · source: NVD
I5
Inspiron 5509 Firmware · Dell
before 1.30.0 · source: NVD
P3
Precision 3660 Firmware · Dell
before 2.14.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-28970
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-28970
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000225476/dsa-2024-168
More from G7 7500 Firmware
7.8
CVE-2022-26861
Dell BIOS versions contain an Insecure Automated Optimization vulnerability
7.8
CVE-2022-26860
Dell BIOS versions contain a stack-based buffer overflow vulnerability
7.8
CVE-2022-26858
Dell BIOS versions contain an Improper Authentication vulnerability
7.5
CVE-2021-21574
Dell BIOSConnect feature contains a buffer overflow vulnerability
7.5
CVE-2021-21573
Dell BIOSConnect feature contains a buffer overflow vulnerability