CVE-2021-36283

CWE-20 — Improper Input Validation3 documents3 sources

Severity

6.7MEDIUM

EPSS

0.0%

top 87.87%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dell CPG Bios Dell Chengming 3990 Firmware Dell Chengming 3991 Firmware +83 more

Timeline

PublishedSep 28

Latest updateMay 24

Description

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 0.8 | Impact: 6.0

Affected Packages86 packages

▶CVEListV5dell/cpg_biosunspecified — 1.3.1

▶NVDdell/xps_7380_firmware< 1.7.0

▶NVDdell/xps_7590_firmware< 1.9.1

▶NVDdell/xps_9500_firmware< 1.6.1

▶NVDdell/wyse_5470_firmware< 1.6.0

Patches

Patch: www.dell.com ↗Patch: www.dell.com ↗

🔴Vulnerability Details

GHSA

GHSA-v8xg-293g-mwp4: Dell BIOS contains an improper input validation vulnerability↗2022-05-24

▶

CVEList

CVE-2021-36283: Dell BIOS contains an improper input validation vulnerability↗2021-09-28

▶