Vulnerability-Lookup

BDU:2025-04601 (CVE-2022-34403)

Vulnerability from fstec – Published: 2025-04-15 – Updated: 2025-04-15 – View on bdu.fstec.ru Fixed

Title

Уязвимость системы BIOS микропрограммного обеспечения ноутбуков Dell, позволяющая нарушителю выполнить произвольный код

Summary

Уязвимость системы BIOS микропрограммного обеспечения ноутбуков Dell связана с переполнением буфера в стеке. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код

Severity

5.9 (Medium) CVSS 2.0


                      
                        AV:L/AC:H/Au:M/C:C/I:C/A:C

7.5 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-121 - Переполнение буфера в стеке
CWE-787 - Запись за границами буфера

Aliases

CVE-2022-34403, DSA-2022-327

References

2 references

URL
https://www.dell.com/support/kbdoc/000205716
https://vuldb.com/?id.219909

Impacted products

51 products from 1 vendor

Vendors

Dell Technologies

Products

Inspiron 3505, Inspiron 3515, Inspiron 3525, Inspiron 3595, Inspiron 3585, Inspiron 3785, Inspiron 3891, Latitude 5320, Latitude 5420, Latitude 5520, Latitude 5521, Precision 5560, Precision 5760, Vostro 3690, Vostro 3510, Vostro 3890, Vostro 5310, Vostro 5410, OptiPlex 3090 Ultra, OptiPlex 5490 All-in-One, OptiPlex 5090, Latitude Rugged 5430, Inspiron 3275, Inspiron 3475, Inspiron 5310, Inspiron 5405, Inspiron 5410, Inspiron 5415, Inspiron 5485, Inspiron 5485 2-in-1, Inspiron 5505, Inspiron 5515, Inspiron 5585, Inspiron 7405 2-in-1, Inspiron 7415, Inspiron 7510, Inspiron 7610, Latitude 3320, Latitude 3420, Latitude 3520, Latitude 7320, Latitude 7320 Detachable, Latitude 7420, Latitude 7520, Latitude 9420, Latitude 9520, Latitude 5421, OptiPlex 7490 All in One, OptiPlex 7090 Ultra, Precision 7560, Precision 7760

Versions

до 1.9.0 (Inspiron 3505), до 1.9.0 (Inspiron 3515), до 1.5.0 (Inspiron 3525), до 1.5.0 (Inspiron 3595), до 1.10.0 (Inspiron 3585), до 1.10.0 (Inspiron 3785), до 1.12.0 (Inspiron 3891), до 1.24.3 (Latitude 5320), до 1.22.0 (Latitude 5420), до 1.24.3 (Latitude 5520), до 1.17.3 (Latitude 5521), до 1.15.2 (Precision 5560), до 1.15.2 (Precision 5760), до 1.12.0 (Vostro 3690), до 1.18.2 (Vostro 3510), до 1.12.0 (Vostro 3890), до 2.15.0 (Vostro 5310), до 2.15.2 (Vostro 5410), до 1.15.0 (OptiPlex 3090 Ultra), до 1.15.0 (OptiPlex 5490 All-in-One), до 1.12.0 (OptiPlex 5090), до 1.12.0 (Latitude Rugged 5430), до 1.9.2 (Inspiron 3275), до 1.9.2 (Inspiron 3475), до 2.15.0 (Inspiron 5310), до 1.9.0 (Inspiron 5405), до 2.14.0 (Inspiron 5410), до 1.13.0 (Inspiron 5415), до 2.11.0 (Inspiron 5485), до 2.11.0 (Inspiron 5485 2-in-1), до 1.9.0 (Inspiron 5505), до 1.13.0 (Inspiron 5515), до 2.11.0 (Inspiron 5585), до 1.10.1 (Inspiron 7405 2-in-1), до 1.13.0 (Inspiron 7415), до 1.12.0 (Inspiron 7510), до 1.12.0 (Inspiron 7610), до 1.18.2 (Latitude 3320), до 1.23.2 (Latitude 3420), до 1.23.2 (Latitude 3520), до 1.20.0 (Latitude 7320), до 1.17.2 (Latitude 7320 Detachable), до 1.20.0 (Latitude 7420), до 1.20.0 (Latitude 7520), до 1.16.2 (Latitude 9420), до 1.17.0 (Latitude 9520), до 1.15.0 (Latitude 5421), до 1.15.0 (OptiPlex 7490 All in One), до 1.15.0 (OptiPlex 7090 Ultra), до 1.16.0 (Precision 7560), до 1.16.0 (Precision 7760)

Product types

Appliance software, Firmware

Mitigations

Использование рекомендаций: https://www.dell.com/support/kbdoc/000205716

Credits

Более подробный список уязвимых устройств указан на сайте производителя: https://www.dell.com/support/kbdoc/de-de/000205716/dsa-2022-327

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:H/Au:M/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Dell Technologies",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 1.9.0 (Inspiron 3505), \u0434\u043e 1.9.0 (Inspiron 3515), \u0434\u043e 1.5.0 (Inspiron 3525), \u0434\u043e 1.5.0 (Inspiron 3595), \u0434\u043e 1.10.0 (Inspiron 3585), \u0434\u043e 1.10.0 (Inspiron 3785), \u0434\u043e 1.12.0 (Inspiron 3891), \u0434\u043e 1.24.3 (Latitude 5320), \u0434\u043e 1.22.0 (Latitude 5420), \u0434\u043e 1.24.3 (Latitude 5520), \u0434\u043e 1.17.3 (Latitude 5521), \u0434\u043e 1.15.2 (Precision 5560), \u0434\u043e 1.15.2 (Precision 5760), \u0434\u043e 1.12.0 (Vostro 3690), \u0434\u043e 1.18.2 (Vostro 3510), \u0434\u043e 1.12.0 (Vostro 3890), \u0434\u043e 2.15.0 (Vostro 5310), \u0434\u043e 2.15.2 (Vostro 5410), \u0434\u043e 1.15.0 (OptiPlex 3090 Ultra), \u0434\u043e 1.15.0 (OptiPlex 5490 All-in-One), \u0434\u043e 1.12.0 (OptiPlex 5090), \u0434\u043e 1.12.0 (Latitude Rugged 5430), \u0434\u043e 1.9.2 (Inspiron 3275), \u0434\u043e 1.9.2 (Inspiron 3475), \u0434\u043e 2.15.0 (Inspiron 5310), \u0434\u043e 1.9.0 (Inspiron 5405), \u0434\u043e 2.14.0 (Inspiron 5410), \u0434\u043e 1.13.0 (Inspiron 5415), \u0434\u043e 2.11.0 (Inspiron 5485), \u0434\u043e 2.11.0 (Inspiron 5485 2-in-1), \u0434\u043e 1.9.0 (Inspiron 5505), \u0434\u043e 1.13.0 (Inspiron 5515), \u0434\u043e 2.11.0 (Inspiron 5585), \u0434\u043e 1.10.1 (Inspiron 7405 2-in-1), \u0434\u043e 1.13.0 (Inspiron 7415), \u0434\u043e 1.12.0 (Inspiron 7510), \u0434\u043e 1.12.0 (Inspiron 7610), \u0434\u043e 1.18.2 (Latitude 3320), \u0434\u043e 1.23.2 (Latitude 3420), \u0434\u043e 1.23.2 (Latitude 3520), \u0434\u043e 1.20.0 (Latitude 7320), \u0434\u043e 1.17.2 (Latitude 7320 Detachable), \u0434\u043e 1.20.0 (Latitude 7420), \u0434\u043e 1.20.0 (Latitude 7520), \u0434\u043e 1.16.2 (Latitude 9420), \u0434\u043e 1.17.0 (Latitude 9520), \u0434\u043e 1.15.0 (Latitude 5421), \u0434\u043e 1.15.0 (OptiPlex 7490 All in One), \u0434\u043e 1.15.0 (OptiPlex 7090 Ultra), \u0434\u043e 1.16.0 (Precision 7560), \u0434\u043e 1.16.0 (Precision 7760)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://www.dell.com/support/kbdoc/000205716",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "15.12.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "15.04.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "15.04.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-04601",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-34403, DSA-2022-327",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Inspiron 3505, Inspiron 3515, Inspiron 3525, Inspiron 3595, Inspiron 3585, Inspiron 3785, Inspiron 3891, Latitude 5320, Latitude 5420, Latitude 5520, Latitude 5521, Precision 5560, Precision 5760, Vostro 3690, Vostro 3510, Vostro 3890, Vostro 5310, Vostro 5410, OptiPlex 3090 Ultra, OptiPlex 5490 All-in-One, OptiPlex 5090, Latitude Rugged 5430, Inspiron 3275, Inspiron 3475, Inspiron 5310, Inspiron 5405, Inspiron 5410, Inspiron 5415, Inspiron 5485, Inspiron 5485 2-in-1, Inspiron 5505, Inspiron 5515, Inspiron 5585, Inspiron 7405 2-in-1, Inspiron 7415, Inspiron 7510, Inspiron 7610, Latitude 3320, Latitude 3420, Latitude 3520, Latitude 7320, Latitude 7320 Detachable, Latitude 7420, Latitude 7520, Latitude 9420, Latitude 9520, Latitude 5421, OptiPlex 7490 All in One, OptiPlex 7090 Ultra, Precision 7560, Precision 7760",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b BIOS \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 Dell, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0441\u0442\u0435\u043a\u0435 (CWE-121), \u0417\u0430\u043f\u0438\u0441\u044c \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 (CWE-787)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b BIOS \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 Dell \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0441\u0442\u0435\u043a\u0435. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "\u0411\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0443\u043a\u0430\u0437\u0430\u043d \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://www.dell.com/support/kbdoc/de-de/000205716/dsa-2022-327",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.dell.com/support/kbdoc/000205716\nhttps://vuldb.com/?id.219909",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-121, CWE-787",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,9)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

CVE-2022-34403 (GCVE-0-2022-34403)

Vulnerability from cvelistv5 – Published: 2023-02-01 05:19 – Updated: 2025-03-26 18:54

Summary

Dell BIOS contains a Stack based buffer overflow vulnerability. A local authenticated attacker could potentially exploit this vulnerability by using an SMI to send larger than expected input to a parameter to gain arbitrary code execution in SMRAM.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-26 18:54 UTC

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

dell mitre root

References

1 reference

URL	Tags
https://www.dell.com/support/kbdoc/000205716	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Dell	CPG BIOS	Affected: 0 , ≤ 2.15.2 (custom)

Date Public

2022-12-15 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:07:16.250Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/kbdoc/000205716"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-34403",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-26T18:54:35.360153Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-26T18:54:43.424Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPG BIOS",
          "vendor": "Dell",
          "versions": [
            {
              "lessThanOrEqual": "2.15.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2022-12-15T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cdiv\u003e\u003cdiv\u003eDell BIOS contains a Stack based buffer overflow vulnerability. A local authenticated attacker could potentially exploit this vulnerability by using an SMI to send larger than expected input to a parameter to gain arbitrary code execution in SMRAM.\u003c/div\u003e\u003c/div\u003e\n\n"
            }
          ],
          "value": "\nDell BIOS contains a Stack based buffer overflow vulnerability. A local authenticated attacker could potentially exploit this vulnerability by using an SMI to send larger than expected input to a parameter to gain arbitrary code execution in SMRAM.\n\n\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-01T05:19:46.289Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/000205716"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2022-34403",
    "datePublished": "2023-02-01T05:19:46.289Z",
    "dateReserved": "2022-06-23T18:55:17.100Z",
    "dateUpdated": "2025-03-26T18:54:43.424Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.