CVE-2023-28059
MEDIUMCVSS 6.7/10EPSS 0.17%
Last modified
CVE-2023-28059 is a medium-severity vulnerability rated 6.7/10 on the CVSS scale. Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable. . EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dell | Alienware Area 51m R1 Firmware | < 1.26.0 |
| Dell | Alienware Area 51m R2 Firmware | < 1.22.0 |
| Dell | Alienware Aurora R11 Firmware | < 1.0.20 |
| Dell | Alienware Aurora R12 Firmware | < 1.1.20 |
| Dell | Alienware Aurora R13 Firmware | < 1.12.0 |
| Dell | Alienware Aurora R15 Firmware | < 1.1.0 |
| Dell | Alienware M15 R2 Firmware | < 1.22.0 |
| Dell | Alienware M15 R3 Firmware | < 1.23.0 |
| Dell | Alienware M15 R4 Firmware | < 1.17.0 |
| Dell | Alienware M15 R6 Firmware | < 1.21.0 |
| Dell | Alienware M15 R7 Firmware | < 1.16.0 |
| Dell | Alienware M16 Firmware | < 1.7.0 |
| Dell | Alienware M17 R2 Firmware | < 1.22.0 |
| Dell | Alienware M17 R3 Firmware | < 1.23.0 |
| Dell | Alienware M17 R4 Firmware | < 1.17.0 |
| Dell | Alienware X14 Firmware | < 1.12.0 |
| Dell | Alienware X15 R1 Firmware | < 1.18.0 |
| Dell | Alienware X15 R2 Firmware | < 1.13.0 |
| Dell | Alienware X17 R1 Firmware | < 1.18.0 |
| Dell | Alienware X17 R2 Firmware | < 1.13.0 |
| Dell | Chengming 3900 Firmware | < 1.11.0 |
| Dell | Chengming 3901 Firmware | < 1.11.0 |
| Dell | Chengming 3910 Firmware | < 1.1.0 |
| Dell | Chengming 3911 Firmware | < 1.1.0 |
| Dell | Chengming 3980 Firmware | < 2.29.0 |
| Dell | Chengming 3988 Firmware | < 1.15.0 |
| Dell | Chengming 3990 Firmware | < 1.19.0 |
| Dell | Chengming 3991 Firmware | < 1.19.0 |
| Dell | G15 5510 Firmware | < 1.19.0 |
| Dell | G15 5511 Firmware | < 1.21.1 |
| Dell | G15 5520 Firmware | < 1.16.0 |
| Dell | G15 5530 Firmware | < 1.3.0 |
| Dell | G16 7620 Firmware | < 1.16.0 |
| Dell | G3 15 3590 Firmware | < 1.21.0 |
| Dell | G3 3500 Firmware | < 1.24.0 |
| Dell | G3 3579 Firmware | < 1.25.0 |
| Dell | G3 3779 Firmware | < 1.25.0 |
| Dell | G5 15 5500 Firmware | < 1.24.0 |
| Dell | G5 15 5590 Firmware | < 1.24.0 |
| Dell | G5 5000 Firmware | < 1.13.0 |
| Dell | G5 5090 Firmware | < 1.19.0 |
| Dell | G7 15 7500 Firmware | < 1.23.0 |
| Dell | G7 15 7590 Firmware | < 1.24.0 |
| Dell | G7 17 7700 Firmware | < 1.23.0 |
| Dell | G7 17 7790 Firmware | < 1.24.0 |
| Dell | Latitude 3480 Firmware | < 1.24.0 |
| Dell | Latitude 3580 Firmware | < 1.24.0 |
| Dell | Precision 5820 Tower Firmware | < 2.27.0 |
| Dell | Precision 7820 Tower Firmware | < 2.31.0 |
| Dell | Precision 7920 Tower Firmware | < 2.31.0 |
Showing 50 of 435 affected configurations. See NVD for the full list.
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-28059?
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
How severe is CVE-2023-28059?
CVE-2023-28059 has a CVSS score of 6.7/10 (MEDIUM severity). The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2023-28059?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-28052 Dell BIOS contains an improper input validation vulnerabili…6.7
- CVE-2023-28053 Dell NetWorker Virtual Edition versions 19.8 and below cont…5.3
- CVE-2023-28054 Dell BIOS contains an improper input validation vulnerabili…6.7
- CVE-2023-28055 Dell NetWorker, Version 19.7 has an improper authorization …8.8
- CVE-2023-28056 Dell BIOS contains an improper input validation vulnerabili…6.7
- CVE-2023-28058 Dell BIOS contains an improper input validation vulnerabili…6.7
- CVE-2023-2806A vulnerability classified as problematic was found in Weave…8.8
- CVE-2023-28060 Dell BIOS contains an improper input validation vulnerabili…6.7
- CVE-2023-28061 Dell BIOS contains an improper input validation vulnerabili…6.7
- CVE-2023-28062 Dell PPDM versions 19.12, 19.11 and 19.10, contain an impro…8.8
- CVE-2023-28063 Dell BIOS contains a Signed to Unsigned Conversion Error vu…4.4
- CVE-2023-28064 Dell BIOS contains an Out-of-bounds Write vulnerability. An…4.6
Are you affected by CVE-2023-28059?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST