PT-2023-29197 · Dell · Dell Poweredge+1

Published 2023-12-05 · Updated 2023-12-12 · CVE-2023-44298

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS version 1.4.4

Description The issue concerns active debug code security vulnerability in the BIOS. An unauthenticated physical attacker could potentially exploit this, leading to information tampering, code execution, or denial of service.

Recommendations For version 1.4.4, update to a newer version that contains a fix for this issue to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Locking

Weakness Enumeration

CWE-1234

CWE-667

Related Identifiers

CVE-2023-44298

Affected Products

Dell Poweredge

Dell Precision

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-44298 · Security Note
• https://dell.com/support/kbdoc/en-us/000220047/dsa-2023-429-security-update-for-dell-16g-poweredge-server-bios-for-a-debug-code-security-vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-44298 · Vendor Advisory
• https://twitter.com/CVEnew/status/1732072813761339702 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1732095241019113516 · Twitter Post
• https://t.me/cvenotify/63256 · Telegram Post
• https://t.me/cvenotify/62338 · Telegram Post
• https://t.me/cvenotify/62398 · Telegram Post