{"id":"CVE-2023-32472","state":"PUBLISHED","title":"Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit t","description":"Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some code in System Management Mode, leading to arbitrary code execution or escalation of privilege.","publishedAt":"2024-07-10T02:32:00.277Z","updatedAt":"2024-09-26T11:57:38.816Z","severity":{"score":5.7,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","source":"dell"},"assigner":"dell","products":["Dell PowerSwitch Z9664F-ON BIOS"],"affected":[{"vendor":"Dell","product":"PowerSwitch Z9664F-ON BIOS","defaultStatus":"unaffected","versions":[{"version":"N/A","status":"affected","lessThan":"v1.05.10","versionType":"semver"}]}],"references":["https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:06:00.499Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/32xxx/CVE-2023-32472.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-32472","state":"PUBLISHED","datePublished":"2024-07-10T02:32:00.277Z","dateUpdated":"2024-09-26T11:57:38.816Z","assignerShortName":"dell","assignerOrgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateReserved":"2023-05-09T06:07:41.364Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some code in System Management Mode, leading to arbitrary code execution or escalation of privilege."}],"affected":[{"vendor":"Dell","product":"PowerSwitch Z9664F-ON BIOS","defaultStatus":"unaffected","versions":[{"version":"N/A","status":"affected","lessThan":"v1.05.10","versionType":"semver"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"CWE-787: Out-of-bounds Write","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"dell","orgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateUpdated":"2024-09-26T11:57:38.816Z"},"credits":[{"lang":"en","type":"finder","value":"Dell Technologies would like to thank the BINARLY efiXplorer team for reporting these issues"}],"datePublic":"2023-06-14T06:30:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"dell","product":"powerswitch_z9664f_on-bios","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"v1.05.10","versionType":"semver"}],"cpes":["cpe:2.3:a:dell:powerswitch_z9664f_on-bios:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-23T18:34:02.518285Z","id":"CVE-2023-32472","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-23T18:43:41.144Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T15:18:37.025Z"}}]}}}