CVE-2023-32460
HIGHCVSS 7.8/10EPSS 0.19%
Last modified
CVE-2023-32460 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Dell PowerEdge BIOS contains an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation. . EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
Dell PowerEdge BIOS contains an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dell | Poweredge R660 Firmware | < 1.6.6 |
| Dell | Poweredge R760 Firmware | < 1.6.6 |
| Dell | Poweredge C6620 Firmware | < 1.6.6 |
| Dell | Poweredge Mx760c Firmware | < 1.6.6 |
| Dell | Poweredge R860 Firmware | < 1.6.6 |
| Dell | Poweredge R960 Firmware | < 1.6.6 |
| Dell | Poweredge Hs5610 Firmware | < 1.6.6 |
| Dell | Poweredge Hs5620 Firmware | < 1.6.6 |
| Dell | Poweredge R660xs Firmware | < 1.6.6 |
| Dell | Poweredge R760xs Firmware | < 1.6.6 |
| Dell | Poweredge R760xd2 Firmware | < 1.6.6 |
| Dell | Poweredge T560 Firmware | < 1.6.6 |
| Dell | Poweredge R760xa Firmware | < 1.6.6 |
| Dell | Poweredge Xr5610 Firmware | < 1.6.6 |
| Dell | Poweredge Xr8610t Firmware | < 1.6.6 |
| Dell | Poweredge Xr8620t Firmware | < 1.6.6 |
| Dell | Poweredge R6615 Firmware | < 1.6.6 |
| Dell | Poweredge R7615 Firmware | < 1.6.6 |
| Dell | Poweredge Xr7620 Firmware | < 1.6.6 |
| Dell | Poweredge Xe8640 Firmware | < 1.3.6 |
| Dell | Poweredge Xe9640 Firmware | < 1.3.6 |
| Dell | Poweredge Xe9680 Firmware | < 1.3.6 |
| Dell | Poweredge R6625 Firmware | < 1.6.8 |
| Dell | Poweredge R7625 Firmware | < 1.6.8 |
| Dell | Poweredge C6615 Firmware | < 1.1.2 |
| Dell | Poweredge R650 Firmware | < 1.12.1 |
| Dell | Poweredge R750 Firmware | < 1.12.1 |
| Dell | Poweredge R750xa Firmware | < 1.12.1 |
| Dell | Poweredge C6520 Firmware | < 1.12.1 |
| Dell | Poweredge Mx750c Firmware | < 1.12.1 |
| Dell | Poweredge R550 Firmware | < 1.12.1 |
| Dell | Poweredge R450 Firmware | < 1.12.1 |
| Dell | Poweredge R650xs Firmware | < 1.12.1 |
| Dell | Poweredge R750xs Firmware | < 1.12.1 |
| Dell | Poweredge T550 Firmware | < 1.12.1 |
| Dell | Poweredge Xr11 Firmware | < 1.12.1 |
| Dell | Poweredge Xr12 Firmware | < 1.12.1 |
| Dell | Poweredge T150 Firmware | < 1.8.1 |
| Dell | Poweredge T350 Firmware | < 1.8.1 |
| Dell | Poweredge R250 Firmware | < 1.8.1 |
| Dell | Poweredge R350 Firmware | < 1.8.1 |
| Dell | Poweredge Xr4510c Firmware | < 1.13.3 |
| Dell | Poweredge Xr4520c Firmware | < 1.13.3 |
| Dell | Poweredge R6515 Firmware | < 2.13.3 |
| Dell | Poweredge R6525 Firmware | < 2.13.3 |
| Dell | Poweredge R7515 Firmware | < 2.13.3 |
| Dell | Poweredge R7525 Firmware | < 2.13.3 |
| Dell | Poweredge C6525 Firmware | < 2.13.3 |
| Dell | Poweredge Xe8545 Firmware | < 2.13.3 |
| Dell | Poweredge R740 Firmware | < 2.20.1 |
Showing 50 of 126 affected configurations. See NVD for the full list.
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-32460?
Dell PowerEdge BIOS contains an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
How severe is CVE-2023-32460?
CVE-2023-32460 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.19% probability of exploitation in the next 30 days.
How do I fix CVE-2023-32460?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-32453 Dell BIOS contains an improper authentication vulnerability…3.9
- CVE-2023-32454 DUP framework version 4.9.4.36 and prior contains insecure …7.1
- CVE-2023-32455 Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain …5.5
- CVE-2023-32457 Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains a…8.8
- CVE-2023-32458 Dell AppSync, versions 4.4.0.0 to 4.6.0.0 including Service…7.8
- CVE-2023-3246An issue has been discovered in GitLab EE/CE affecting all v…4.3
- CVE-2023-32461 Dell PowerEdge BIOS and Dell Precision BIOS contain a buffe…6.7
- CVE-2023-32462 Dell OS10 Networking Switches running 10.5.2.x and above co…9.8
- CVE-2023-32463 Dell VxRail, version(s) 8.0.100 and earlier contain a denia…7.5
- CVE-2023-32464 Dell VxRail, versions prior to 7.0.450, contain an improper…3.3
- CVE-2023-32465 Dell Power Protect Cyber Recovery, contains an Authenticati…8.8
- CVE-2023-32466Dell Edge Gateway BIOS, versions 3200 and 5200, contains an …5.7
Are you affected by CVE-2023-32460?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST