CVE-2022-26861

HIGH

Dell Alienware M15 R6 Firmware < 1.8.0 - Authenticated Arbitrary Code Execution via SMI

Title source: llm
STIX 2.1

Description

Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://www.dell.com/support/kbdoc/000202194

Scores

CVSS v3 7.9
EPSS 0.0004
EPSS Percentile 13.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Details

CWE
CWE-1038
Status published
Products (50)
dell/alienware_m15_r6_firmware < 1.8.0
dell/chengming_3980_firmware < 2.21.0
dell/chengming_3988_firmware < 1.9.0
dell/chengming_3990_firmware < 1.8.2
dell/chengming_3991_firmware < 1.8.2
dell/edge_gateway_3000_firmware < 1.8.0
dell/edge_gateway_5000_firmware < 1.18.0
dell/embedded_box_pc_3000_firmware < 1.14.0
dell/embedded_box_pc_5000_firmware < 1.15.0
dell/g15_5510_firmware < 1.8.0
... and 40 more
Published Sep 06, 2022
Tracked Since Feb 18, 2026