CVE-2024-25942

Published: Mar 19, 2024Modified: Feb 4, 2025

6.8

Vector

CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Exploitability: 0.5 / Impact: 5.8

Source: NVD

Description

Dell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability. A physical high privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM.

Affected (25)

Dell

25 products

Poweredge R730 Firmware

Poweredge R730xd Firmware

Poweredge R630 Firmware

Poweredge C4130 Firmware

Poweredge R930 Firmware

Poweredge M630 Firmware

Poweredge M630 (pe Vrtx) Firmware

Poweredge Fc630 Firmware

Poweredge Fc430 Firmware

Poweredge M830 Firmware

Poweredge M830 (pe Vrtx) Firmware

Poweredge Fc830 Firmware

Poweredge T630 Firmware

Poweredge R530 Firmware

Poweredge R430 Firmware

Poweredge T430 Firmware

Poweredge R830 Firmware

Poweredge C6320 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge R730 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge R730	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge R730xd Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge R730xd	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge R630 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge R630	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge C4130 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge C4130	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge R930 Firmware	Before 2.14.0

Running on/with	Platform Versions
Dell Poweredge R930	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge M630 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge M630	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge M630 (pe Vrtx) Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge M630 (pe Vrtx)	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge Fc630 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge Fc630	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge Fc430 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge Fc430	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge M830 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge M830	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge M830 (pe Vrtx) Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge M830 (pe Vrtx)	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge Fc830 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge Fc830	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge T630 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge T630	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge R530 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge R530	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge R430 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge R430	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge T430 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge T430	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge R830 Firmware	Before 1.19.0

Running on/with	Platform Versions
Dell Poweredge R830	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Poweredge C6320 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Poweredge C6320	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Nx3230 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Nx3230	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Nx3330 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Nx3330	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Xc6320 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Xc6320	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Xc430 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Xc430	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Xc630 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Xc630	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Xc730 Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Xc730	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Xc730xd Firmware	Before 2.19.0

Running on/with	Platform Versions
Dell Xc730xd	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://www.dell.com/support/kbdoc/en-us/000223210/dsa-2024-104-security-update-for-dell-poweredge-server-bios-for-an-improper-smm-communication-buffer-verification-vulnerability

Source: security_alert@emc.com

Vendor Advisory

https://www.dell.com/support/kbdoc/en-us/000223210/dsa-2024-104-security-update-for-dell-poweredge-server-bios-for-an-improper-smm-communication-buffer-verification-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.