CVE-2023-25537

MEDIUM

Dell PowerEdge 14G Server BIOS < 2.18.1 - Out-of-bounds Write

Title source: llm
STIX 2.1

Description

Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability. A local attacker with low privileges could potentially exploit this vulnerability leading to exposure of some SMRAM stack/data/code in System Management Mode, leading to arbitrary code execution or escalation of privilege.

References (1)

Core 1

Scores

CVSS v3 6.1
EPSS 0.0005
EPSS Percentile 15.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-787
Status published
Products (30)
dell/dss_8440_firmware < 2.18.1
dell/emc_storage_nx3240_firmware < 2.18.1
dell/emc_storage_nx3340_firmware < 2.18.1
dell/emc_xc_core_6420_firmware < 2.18.1
dell/emc_xc_core_xc640_firmware < 2.18.1
dell/emc_xc_core_xc740xd2_firmware < 2.18.1
dell/emc_xc_core_xc740xd_firmware < 2.18.1
dell/emc_xc_core_xc940_firmware < 2.18.1
dell/emc_xc_core_xcxr2_firmware < 2.18.1
dell/poweredge_c4140_firmware < 2.18.1
... and 20 more
Published May 22, 2023
Tracked Since Feb 18, 2026