Threat Investigation
Request a demo

CVE-2022-34408

High

Description

Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.

SeverityHigh
CVSS7.5
Exploit probability—
ProductDell R6515 Firmware
PublishedMar 16, 2023
First seenMar 16, 2023
Weakness typeCWE-119Memory buffer bounds error

How to fix

Update
  • dell r6515_firmware2.9.3 or later
  • dell r7515_firmware2.9.3 or later
  • dell r6525_firmware2.9.3 or later
  • dell r7525_firmware2.9.3 or later
  • dell xe8545_firmware2.9.4 or later
  • dell r6415_firmware1.19.0 or later
  • dell r7415_firmware1.19.0 or later
  • dell r7425_firmware1.19.0 or later
  • dell r750_firmware1.8.2 or later
  • dell r750xa_firmware1.8.2 or later
  • dell r650_firmware1.8.2 or later
  • dell c6520_firmware1.8.2 or later
Vendor advisories

Affected products

ProductAffected versionsFixed in
dell r6515_firmwarev < 2.9.32.9.3
dell r7515_firmwarev < 2.9.32.9.3
dell r6525_firmwarev < 2.9.32.9.3
dell r7525_firmwarev < 2.9.32.9.3
dell xe8545_firmwarev < 2.9.42.9.4
dell c6525_firmwareNo range specified—
dell r6415_firmwarev < 1.19.01.19.0
dell r7415_firmwarev < 1.19.01.19.0
dell r7425_firmwarev < 1.19.01.19.0
dell r750_firmwarev < 1.8.21.8.2
dell r750xa_firmwarev < 1.8.21.8.2
dell r650_firmwarev < 1.8.21.8.2
dell c6520_firmwarev < 1.8.21.8.2
dell mx750c_firmwarev < 1.8.21.8.2
dell r450_firmwarev < 1.8.21.8.2
dell r550_firmwarev < 1.8.21.8.2
dell r650xs_firmwarev < 1.8.21.8.2
dell r750xs_firmwarev < 1.8.21.8.2
dell t550_firmwarev < 1.8.21.8.2
dell xr11_firmwarev < 1.8.21.8.2
dell xr12_firmwarev < 1.8.21.8.2
dell r250_firmwarev < 1.4.21.4.2
dell r350_firmwarev < 1.4.21.4.2
dell t150_firmwarev < 1.4.21.4.2
dell t350_firmwarev < 1.4.21.4.2
dell r740_firmwarev < 2.16.12.16.1
dell r740xd_firmwarev < 2.16.12.16.1
dell r640_firmwarev < 2.16.12.16.1
dell r940_firmwarev < 2.16.12.16.1
dell r540_firmwarev < 2.16.12.16.1
dell r440_firmwarev < 2.16.12.16.1
dell t440_firmwarev < 2.16.12.16.1
dell xr2_firmwarev < 2.16.12.16.1
dell r740xd2_firmwarev < 2.16.12.16.1
dell r840_firmwarev < 2.16.12.16.1
dell r940xa_firmwarev < 2.16.12.16.1
dell t640_firmwarev < 2.16.12.16.1
dell c6420_firmwarev < 2.16.12.16.1
dell fc640_firmwarev < 2.16.12.16.1
dell m640_firmwarev < 2.16.12.16.1
dell m640p_firmwarev < 2.16.12.16.1
dell mx740c_firmwarev < 2.16.12.16.1
dell mx840c_firmwarev < 2.16.12.16.1
dell c4140_firmwarev < 2.16.12.16.1
dell dss8440_firmwarev < 2.16.12.16.1
dell t140_firmwarev < 2.11.12.11.1
dell t340_firmwarev < 2.11.12.11.1
dell r240_firmwarev < 2.11.12.11.1
dell r340_firmwarev < 2.11.12.11.1
dell xe2420_firmwarev < 2.16.02.16.0
dell xe7420_firmwarev < 2.16.12.16.1
dell xe7440_firmwarev < 2.16.12.16.1
dell r730_firmwarev < 2.16.02.16.0
dell r730xd_firmwarev < 2.16.02.16.0
dell r630_firmwarev < 2.16.02.16.0
dell c4130_firmwarev < 2.16.02.16.0
dell r930_firmwarev < 2.16.02.16.0
dell m630_firmwarev < 2.16.02.16.0
dell m630p_firmwarev < 2.16.02.16.0
dell fc630_firmwarev < 2.16.02.16.0
dell fc430_firmwarev < 2.16.02.16.0
dell m830_firmwarev < 2.16.02.16.0
dell m830p_firmwarev < 2.16.02.16.0
dell fc830_firmwarev < 2.16.02.16.0
dell t630_firmwarev < 2.16.02.16.0
dell r530_firmwarev < 2.16.02.16.0
dell r430_firmwarev < 2.16.02.16.0
dell t430_firmwarev < 2.16.02.16.0
dell r830_firmwarev < 1.16.01.16.0
dell c6320_firmwarev < 2.16.02.16.0
dell t130_firmwarev < 2.16.02.16.0
dell r230_firmwarev < 2.16.02.16.0
dell t330_firmwarev < 2.16.02.16.0
dell r330_firmwarev < 2.16.02.16.0
dell nx430_firmwarev < 2.16.02.16.0
dell nx3230_firmwarev < 2.16.02.16.0
dell nx3330_firmwarev < 2.16.02.16.0
dell nx440_firmwarev < 2.11.12.11.1
dell nx3240_firmwarev < 2.16.12.16.1
dell nx3340_firmwarev < 2.16.12.16.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.