CVE-2019-3717

published 2019-08-05

CVE-2019-3717: Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical access to the system…

Priority P4 27 medium 6.8 CVSS 3.1

AV P AC L PR N UI N S U C H I H A H

Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical access to the system could potentially bypass intended Secure Boot restrictions to run unsigned and untrusted code on expansion cards installed in the system during platform boot. Refer to https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019-043-dell-client-improper-access-control-vulnerability?lang=en for versions affected by this vulnerability.

Affected

240 ranges · showing 25

Vendor	Product	Version range	Fixed in
dell	chengming_3967_firmware	< 1.5.0	1.5.0
dell	chengming_3977_firmware	< 1.6.0	1.6.0
dell	chengming_3980_firmware	< 1.5.21	1.5.21
dell	dell_client_commercial_and_consumer_platforms	—	—
dell	embedded_box_pc_5000_firmware	< 1.5.6	1.5.6
dell	g3_3579_firmware	< 1.9.0	1.9.0
dell	g3_3779_firmware	< 1.9.0	1.9.0
dell	g5_5587_firmware	< 1.10.0	1.10.0
dell	g5_5590_firmware	< 1.3.1	1.3.1
dell	g7_7588_firmware	< 1.10.0	1.10.0
dell	g7_7590_firmware	< 1.3.1	1.3.1
dell	g7_7790_firmware	< 1.3.1	1.3.1
dell	inspiron_3153_firmware	< 1.22.0	1.22.0
dell	inspiron_3158_firmware	< 1.22.0	1.22.0
dell	inspiron_3268_firmware	< 1.11.1	1.11.1
dell	inspiron_3458_firmware	< a18	a18
dell	inspiron_3459_firmware	< 1.9.0	1.9.0
dell	inspiron_3467_firmware	< 2.9.0	2.9.0
dell	inspiron_3468_firmware	< 1.12.0	1.12.0
dell	inspiron_3470_firmware	< 1.5.21	1.5.21
dell	inspiron_3476_firmware	< 1.7.0	1.7.0
dell	inspiron_3480_firmware	< 1.4.1	1.4.1
dell	inspiron_3481_firmware	< 1.2.0	1.2.0
dell	inspiron_3558_firmware	< a18	a18
dell	inspiron_3559_firmware	< 1.9.0	1.9.0

CVSS provenance

nvd v3.1 6.8 MEDIUM CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 7.1 HIGH CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H

nvd v2.0 7.2 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.