CVE-2023-32472

Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some code in System Management Mode, leading to arbitrary code execution or escalation of privilege.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.5 / Impact : 3.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200	Vendor Advisory
https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dell:edge_gateway_3200_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:dell:edge_gateway_3200:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:dell:edge_gateway_5200_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:edge_gateway_5200:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-07-10 03:15

Updated : 2024-11-21 08:03

NVD link : CVE-2023-32472

Mitre link : CVE-2023-32472

CVE.ORG link : CVE-2023-32472

JSON object : View

Products Affected

dell

edge_gateway_3200_firmware
edge_gateway_5200_firmware
edge_gateway_3200
edge_gateway_5200

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2023-32472", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}]}, "published": "2024-07-10T03:15:02.193", "references": [{"url": "https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some code in System Management Mode, leading to arbitrary code execution or escalation of privilege."}, {"lang": "es", "value": "El BIOS de Dell Edge Gateway, versiones 3200 y 5200, contiene una vulnerabilidad de escritura fuera de los l\u00edmites. Un usuario malintencionado local autenticado con altos privilegios podr\u00eda explotar esta vulnerabilidad, lo que provocar\u00eda la exposici\u00f3n de parte del c\u00f3digo en el modo de administraci\u00f3n del sistema, lo que provocar\u00eda la ejecuci\u00f3n de c\u00f3digo arbitrario o una escalada de privilegios."}], "lastModified": "2024-11-21T08:03:25.637", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:edge_gateway_3200_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44A5114F-DF4F-4E59-9644-079B266D3C7E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:edge_gateway_3200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FBA59414-5A32-4706-85A5-D5459EE22BA5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:edge_gateway_5200_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A390E554-5359-4D9F-B5FA-A62CFE7471E0", "versionEndExcluding": "1.05.10"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:edge_gateway_5200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F6832A53-E950-4572-A178-CF5DC14CACC5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security_alert@emc.com"}