Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-24418: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution durin...

CVE-2022-24418 · published 4 years ago

Summary

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.

What to do

Update dell dell_g5_5505_firmware to version 1.10.0 or later.
Update dell inspiron_22-3275_firmware to version 1.8.0 or later.
Update dell inspiron_24-3475_firmware to version 1.8.0 or later.
Update dell inspiron_27_7775_firmware to version 2.15.0 or later.
Update dell inspiron_3180_firmware to version 1.4.4 or later.
Update dell inspiron_3185_firmware to version 1.4.4 or later.
Update dell inspiron_3195_firmware to version 1.4.1 or later.
Update dell inspiron_3505_firmware to version 1.5.0 or later.
Update dell inspiron_3515_firmware to version 1.4.0 or later.
Update dell inspiron_3585_firmware to version 1.6.0 or later.
Update dell inspiron_3595_firmware to version 1.2.1 or later.
Update dell inspiron_3785_firmware to version 1.6.0 or later.
Update dell inspiron_5405_firmware to version 1.6.0 or later.
Update dell inspiron_5415_firmware to version 1.7.1 or later.
Update dell inspiron_5485_firmware to version 2.7.0 or later.
Update dell inspiron_5505_firmware to version 1.6.0 or later.
Update dell inspiron_5515_firmware to version 1.7.1 or later.
Update dell inspiron_5575_firmware to version 1.5.0 or later.
Update dell inspiron_5585_firmware to version 2.7.0 or later.
Update dell inspiron_5675_firmware to version 1.5.0 or later.
Update dell inspiron_5775_firmware to version 1.5.0 or later.
Update dell inspiron_7375_firmware to version 1.6.0 or later.
Update dell inspiron_7405_firmware to version 1.7.0 or later.
Update dell inspiron_7415_firmware to version 1.7.1 or later.
Update dell vostro_3405_firmware to version 1.5.0 or later.
Update dell vostro_3515_firmware to version 1.4.0 or later.
Update dell vostro_5415_firmware to version 1.7.1 or later.
Update dell vostro_5515_firmware to version 1.7.1 or later.

Affected software

Vendor	Product	Affected versions
dell	dell_g5_5505_firmware	< 1.10.0 `cpe:2.3:o:dell:dell_g5_5505_firmware::::::::`
dell	inspiron_22-3275_firmware	< 1.8.0 `cpe:2.3:o:dell:inspiron_22-3275_firmware::::::::`
dell	inspiron_24-3475_firmware	< 1.8.0 `cpe:2.3:o:dell:inspiron_24-3475_firmware::::::::`
dell	inspiron_27_7775_firmware	< 2.15.0 `cpe:2.3:o:dell:inspiron_27_7775_firmware::::::::`
dell	inspiron_3180_firmware	< 1.4.4 `cpe:2.3:o:dell:inspiron_3180_firmware::::::::`
dell	inspiron_3185_firmware	< 1.4.4 `cpe:2.3:o:dell:inspiron_3185_firmware::::::::`
dell	inspiron_3195_firmware	< 1.4.1 `cpe:2.3:o:dell:inspiron_3195_firmware::::::::`
dell	inspiron_3505_firmware	< 1.5.0 `cpe:2.3:o:dell:inspiron_3505_firmware::::::::`
dell	inspiron_3515_firmware	< 1.4.0 `cpe:2.3:o:dell:inspiron_3515_firmware::::::::`
dell	inspiron_3585_firmware	< 1.6.0 `cpe:2.3:o:dell:inspiron_3585_firmware::::::::`
dell	inspiron_3595_firmware	< 1.2.1 `cpe:2.3:o:dell:inspiron_3595_firmware::::::::`
dell	inspiron_3785_firmware	< 1.6.0 `cpe:2.3:o:dell:inspiron_3785_firmware::::::::`
dell	inspiron_5405_firmware	< 1.6.0 `cpe:2.3:o:dell:inspiron_5405_firmware::::::::`
dell	inspiron_5415_firmware	< 1.7.1 `cpe:2.3:o:dell:inspiron_5415_firmware::::::::`
dell	inspiron_5485_firmware	< 2.7.0 `cpe:2.3:o:dell:inspiron_5485_firmware::::::::`
dell	inspiron_5505_firmware	< 1.6.0 `cpe:2.3:o:dell:inspiron_5505_firmware::::::::`
dell	inspiron_5515_firmware	< 1.7.1 `cpe:2.3:o:dell:inspiron_5515_firmware::::::::`
dell	inspiron_5575_firmware	< 1.5.0 `cpe:2.3:o:dell:inspiron_5575_firmware::::::::`
dell	inspiron_5585_firmware	< 2.7.0 `cpe:2.3:o:dell:inspiron_5585_firmware::::::::`
dell	inspiron_5675_firmware	< 1.5.0 `cpe:2.3:o:dell:inspiron_5675_firmware::::::::`
dell	inspiron_5775_firmware	< 1.5.0 `cpe:2.3:o:dell:inspiron_5775_firmware::::::::`
dell	inspiron_7375_firmware	< 1.6.0 `cpe:2.3:o:dell:inspiron_7375_firmware::::::::`
dell	inspiron_7405_firmware	< 1.7.0 `cpe:2.3:o:dell:inspiron_7405_firmware::::::::`
dell	inspiron_7415_firmware	< 1.7.1 `cpe:2.3:o:dell:inspiron_7415_firmware::::::::`
dell	vostro_3405_firmware	< 1.5.0 `cpe:2.3:o:dell:vostro_3405_firmware::::::::`
dell	vostro_3515_firmware	< 1.4.0 `cpe:2.3:o:dell:vostro_3515_firmware::::::::`
dell	vostro_5415_firmware	< 1.7.1 `cpe:2.3:o:dell:vostro_5415_firmware::::::::`
dell	vostro_5515_firmware	< 1.7.1 `cpe:2.3:o:dell:vostro_5515_firmware::::::::`

Original advisory text

References

https://www.dell.com/support/kbdoc/en-us/000199285/dsa-2022-095 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

6.7 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published26 May 2022

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-24418 · NVD

Track software like this

Free during beta