CVE-2015-0949

Name: CVE-2015-0949
Creator: NVD / NIST
Published: 2020-01-30T21:15:14.417+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.8/10EPSS 0.39%

Last modified Jun 17, 2026

CVE-2015-0949 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implementations does not ensure that function calls operate on SMRAM memory locations, which allows local users to bypass the Secure Boot protection mechanism and gain privileges by leveraging write access to physical memory.. EPSS estimates a 0.39% chance of exploitation in the next 30 days.

Description

The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implementations does not ensure that function calls operate on SMRAM memory locations, which allows local users to bypass the Secure Boot protection mechanism and gain privileges by leveraging write access to physical memory.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.39%

31.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-269

Affected Software

Vendor	Product	Versions
Dell	Latitude E6430 Firmware	a09
Hp	Elitebook 850 G1 Firmware	01.09

References

http://www.kb.cert.org/vuls/id/631788Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/631788Third Party Advisory, US Government Resource

Timeline

Published: Jan 30, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2015-0949?

How severe is CVE-2015-0949?

CVE-2015-0949 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.39% probability of exploitation in the next 30 days.

How do I fix CVE-2015-0949?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2015-0949?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST