CVE-2023-25537
Medium
Description
Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability. A local attacker with low privileges could potentially exploit this vulnerability leading to exposure of some SMRAM stack/data/code in System Management Mode, leading to arbitrary code execution or escalation of privilege.
SeverityMedium
CVSS6.1
Exploit probability—
ProductDell Poweredge R740 Firmware
PublishedMay 22, 2023
First seenMay 22, 2023
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- dell poweredge_r740_firmware2.18.1 or later
- dell poweredge_r740xd_firmware2.18.1 or later
- dell poweredge_r640_firmware2.18.1 or later
- dell poweredge_r940_firmware2.18.1 or later
- dell poweredge_r540_firmware2.18.1 or later
- dell poweredge_r440_firmware2.18.1 or later
- dell poweredge_t440_firmware2.18.1 or later
- dell poweredge_xr2_firmware2.18.1 or later
- dell poweredge_r740xd2_firmware2.18.1 or later
- dell poweredge_r840_firmware2.18.1 or later
- dell poweredge_r940xa_firmware2.18.1 or later
- dell poweredge_t640_firmware2.18.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell poweredge_r740_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_r740xd_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_r640_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_r940_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_r540_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_r440_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_t440_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_xr2_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_r740xd2_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_r840_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_r940xa_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_t640_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_c6420_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_fc640_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_m640_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_mx740c_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_mx840c_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_c4140_firmware | v < 2.18.1 | 2.18.1 |
| dell dss_8440_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_xe2420_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_xe7420_firmware | v < 2.18.1 | 2.18.1 |
| dell poweredge_xe7440_firmware | v < 2.18.1 | 2.18.1 |
| dell emc_storage_nx3240_firmware | v < 2.18.1 | 2.18.1 |
| dell emc_storage_nx3340_firmware | v < 2.18.1 | 2.18.1 |
| dell emc_xc_core_6420_firmware | v < 2.18.1 | 2.18.1 |
| dell emc_xc_core_xc640_firmware | v < 2.18.1 | 2.18.1 |
| dell emc_xc_core_xc740xd_firmware | v < 2.18.1 | 2.18.1 |
| dell emc_xc_core_xc740xd2_firmware | v < 2.18.1 | 2.18.1 |
| dell emc_xc_core_xc940_firmware | v < 2.18.1 | 2.18.1 |
| dell emc_xc_core_xcxr2_firmware | v < 2.18.1 | 2.18.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.