CVE-2023-32467

Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some UEFI code, leading to arbitrary code execution or escalation of privilege.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.5 / Impact : 3.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200	Vendor Advisory
https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dell:edge_gateway_5000_firmware:0.1.19.0:*:*:*:*:*:*:*

cpe:2.3:h:dell:edge_gateway_5000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:dell:edge_gateway_5100_firmware:0.1.19.0:*:*:*:*:*:*:*

cpe:2.3:h:dell:edge_gateway_5100:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:dell:edge_gateway_5200_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:edge_gateway_5200:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:dell:edge_gateway_3200_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:dell:edge_gateway_3200:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:dell:xps_13_9350_firmware:0.1.13.0:*:*:*:*:*:*:*

cpe:2.3:h:dell:xps_13_9350:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:dell:chengming_3977_firmware:0.1.13.0:*:*:*:*:*:*:*

cpe:2.3:h:dell:chengming_3977:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-07-10 03:15

Updated : 2024-11-21 08:03

NVD link : CVE-2023-32467

Mitre link : CVE-2023-32467

CVE.ORG link : CVE-2023-32467

JSON object : View

Products Affected

dell

edge_gateway_3200
xps_13_9350_firmware
edge_gateway_5200_firmware
edge_gateway_3200_firmware
edge_gateway_5100
chengming_3977
edge_gateway_5200
edge_gateway_5000
edge_gateway_5100_firmware
edge_gateway_5000_firmware
chengming_3977_firmware
xps_13_9350

CWE

CWE-665

Improper Initialization

{"id": "CVE-2023-32467", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}]}, "published": "2024-07-10T03:15:01.870", "references": [{"url": "https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-665"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-665"}]}], "descriptions": [{"lang": "en", "value": "Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some UEFI code, leading to arbitrary code execution or escalation of privilege."}, {"lang": "es", "value": "El BIOS de Dell Edge Gateway, versiones 3200 y 5200, contiene una vulnerabilidad de escritura fuera de los l\u00edmites. Un usuario malicioso local autenticado con altos privilegios podr\u00eda explotar esta vulnerabilidad, lo que provocar\u00eda la exposici\u00f3n de alg\u00fan c\u00f3digo UEFI, lo que provocar\u00eda la ejecuci\u00f3n de c\u00f3digo arbitrario o una escalada de privilegios."}], "lastModified": "2024-11-21T08:03:24.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:edge_gateway_5000_firmware:0.1.19.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDB12C09-4D3F-41C7-BD6F-D21A94C90D4C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:edge_gateway_5000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7B42C9EA-86DD-4643-8F5D-FCE91AEF9253"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:edge_gateway_5100_firmware:0.1.19.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AAEE4CDC-BE00-4D94-98A3-C7292B3477BC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:edge_gateway_5100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FB5D8F56-FBBB-4B2D-9720-5A806490F533"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:edge_gateway_5200_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A390E554-5359-4D9F-B5FA-A62CFE7471E0", "versionEndExcluding": "1.05.10"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:edge_gateway_5200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F6832A53-E950-4572-A178-CF5DC14CACC5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:edge_gateway_3200_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44A5114F-DF4F-4E59-9644-079B266D3C7E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:edge_gateway_3200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FBA59414-5A32-4706-85A5-D5459EE22BA5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:xps_13_9350_firmware:0.1.13.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1AC73052-280D-40B5-89B4-53902F6E52D1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:xps_13_9350:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DAAAFC3F-135F-40E3-8E50-1D2F8BA9C2D0"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:chengming_3977_firmware:0.1.13.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96E31B32-7407-49E7-B4CB-96151E19667F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:chengming_3977:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "67FCCE7C-BAC7-43F2-B328-C3AFD80B6AF0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security_alert@emc.com"}