Vulnerability-Lookup

VAR-202405-3505

Vulnerability from variot - Updated: 2025-02-04 23:33

Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to arbitrary code execution. Dell Edge Gateway 5000 firmware, precision 5820 tower firmware, Dell Edge Gateway 3000 Unspecified vulnerabilities exist in multiple Dell products, including firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202405-3505",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "embedded box pc 5000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.25.0"
      },
      {
        "model": "precision 3620 tower",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "2.30.0"
      },
      {
        "model": "latitude 5290",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.35.0"
      },
      {
        "model": "latitude 5580",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.36.0"
      },
      {
        "model": "latitude 7424 rugged extreme",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.32.0"
      },
      {
        "model": "latitude 5288",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.36.0"
      },
      {
        "model": "latitude 7280",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.37.0"
      },
      {
        "model": "precision 5520",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.38.0"
      },
      {
        "model": "edge gateway 5000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.28.0"
      },
      {
        "model": "latitude 3390 2-in-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.31.0"
      },
      {
        "model": "latitude 5400",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.30.0"
      },
      {
        "model": "latitude 7480",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.37.0"
      },
      {
        "model": "latitude 7380",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.37.0"
      },
      {
        "model": "latitude 7414 rugged",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.46.0"
      },
      {
        "model": "latitude 7290",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.38.0"
      },
      {
        "model": "latitude 7390",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.38.0"
      },
      {
        "model": "latitude 5490",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.35.0"
      },
      {
        "model": "latitude 5420 rugged",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.32.0"
      },
      {
        "model": "optiplex 7450 all-in-one",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.32.0"
      },
      {
        "model": "latitude 7285 2-in-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.26.0"
      },
      {
        "model": "latitude 5280",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.36.0"
      },
      {
        "model": "optiplex 3050 all-in-one",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.32.0"
      },
      {
        "model": "precision 3420 tower",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "2.30.0"
      },
      {
        "model": "latitude 5290 2-in-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.34.0"
      },
      {
        "model": "precision 3520",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.36.0"
      },
      {
        "model": "latitude 5488",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.36.0"
      },
      {
        "model": "latitude 7390 2-in-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.35.0"
      },
      {
        "model": "latitude 5424 rugged",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.32.0"
      },
      {
        "model": "latitude 5590",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.35.0"
      },
      {
        "model": "latitude 3190",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.34.0"
      },
      {
        "model": "latitude 3180",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.29.0"
      },
      {
        "model": "precision 7720",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.36.0"
      },
      {
        "model": "latitude 7212 rugged extreme tablet",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.50.0"
      },
      {
        "model": "precision 7520",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.36.0"
      },
      {
        "model": "latitude 3190 2-in-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.34.0"
      },
      {
        "model": "latitude 12 rugged extreme 7214",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.46.0"
      },
      {
        "model": "wyse 7040 thin client",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.25.0"
      },
      {
        "model": "latitude 5480",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.36.0"
      },
      {
        "model": "latitude 13 3380",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.27.0"
      },
      {
        "model": "latitude 3189",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.29.0"
      },
      {
        "model": "wyse 5070",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.31.0"
      },
      {
        "model": "optiplex 5050",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.30.0"
      },
      {
        "model": "latitude 7490",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.38.0"
      },
      {
        "model": "optiplex 3050",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.30.0"
      },
      {
        "model": "precision 5820 tower",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "2.36.0"
      },
      {
        "model": "precision 5530 2-in-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.31.8"
      },
      {
        "model": "latitude 3300",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.28.0"
      },
      {
        "model": "edge gateway 3000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.18.0"
      },
      {
        "model": "latitude 5414 rugged",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.46.0"
      },
      {
        "model": "embedded box pc 3000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "1.24.0"
      },
      {
        "model": "embedded box pc 5000",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 3189",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 5288",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 3390 2-in-1",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 5400",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 5420 rugged",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 13 3380",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 3190 2-in-1",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "dell edge gateway 5000",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 12 rugged extreme 7214",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 3180",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "precision 5820 tower",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "dell edge gateway 3000",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 5290 2-in-1",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 5414 rugged",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 5290",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 3190",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 5280",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "latitude 3300",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      },
      {
        "model": "embedded box pc 3000",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c7\u30eb",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-017849"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-22429"
      }
    ]
  },
  "cve": "CVE-2024-22429",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "author": "security_alert@emc.com",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 0.8,
            "id": "CVE-2024-22429",
            "impactScore": 6.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 0.8,
            "id": "CVE-2024-22429",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 6.7,
            "baseSeverity": "Medium",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2024-22429",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "High",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "security_alert@emc.com",
            "id": "CVE-2024-22429",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2024-22429",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2024-22429",
            "trust": 0.8,
            "value": "Medium"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-017849"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-22429"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-22429"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to arbitrary code execution. Dell Edge Gateway 5000 firmware, precision 5820 tower firmware, Dell Edge Gateway 3000 Unspecified vulnerabilities exist in multiple Dell products, including firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2024-22429"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-017849"
      }
    ],
    "trust": 1.62
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2024-22429",
        "trust": 2.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-017849",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-017849"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-22429"
      }
    ]
  },
  "id": "VAR-202405-3505",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.351984125
  },
  "last_update_date": "2025-02-04T23:33:52.924000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-20",
        "trust": 1.0
      },
      {
        "problemtype": "Inappropriate input confirmation (CWE-20) [ others ]",
        "trust": 0.8
      },
      {
        "problemtype": " Lack of information (CWE-noinfo) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-017849"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-22429"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://www.dell.com/support/kbdoc/en-us/000221102/dsa-2024-020"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2024-22429"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-017849"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-22429"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-017849"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-22429"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-01-31T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2024-017849"
      },
      {
        "date": "2024-05-17T16:15:07.477000",
        "db": "NVD",
        "id": "CVE-2024-22429"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-01-31T07:37:00",
        "db": "JVNDB",
        "id": "JVNDB-2024-017849"
      },
      {
        "date": "2025-01-30T15:48:29.167000",
        "db": "NVD",
        "id": "CVE-2024-22429"
      }
    ]
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vulnerabilities in multiple Dell products",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-017849"
      }
    ],
    "trust": 0.8
  }
}

CVE-2024-22429 (GCVE-0-2024-22429)

Vulnerability from cvelistv5 – Published: 2024-05-17 15:20 – Updated: 2024-08-01 22:43

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-21 13:54 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

dell CNA under the mitre root

CNA scorecard C 70/100 over 575 records in the last 180 days details

References

1 reference

URL	Tags
https://www.dell.com/support/kbdoc/en-us/00022110…	vendor-advisory

Impacted products

16 products

Vendor	Product	Version
Dell	CPG BIOS	Affected: N/A , < 2.36.0 (semver) Affected: N/A , < 1.18.0 (semver) Affected: N/A , < 1.46.0 (semver) Affected: N/A , < 1.27.0 (semver) Affected: N/A , < 1.29.0 (semver) Affected: N/A , < 1.28.0 (semver) Affected: N/A , < 1.31.0 (semver) Affected: N/A , < 1.32.0 (semver) Affected: N/A , < 1.50.0 (semver) Affected: N/A , < 2.30.0 (semver)
dell	edge_gateway_3000_firmware	Affected: 0 , < 1.18.0 (semver) cpe:2.3:o:dell:edge_gateway_3000_firmware:-:::::::*
dell	latitude_13_3380	Affected: 0 , < 1.27.0 (semver) cpe:2.3:h:dell:latitude_13_3380:-:::::::*
dell	latitude_3180_firmware	Affected: 0 , < 1.29.0 (semver) cpe:2.3:o:dell:latitude_3180_firmware:-:::::::*
dell	latitude_3189_firmware	Affected: 0 , < 1.29.0 (semver) cpe:2.3:o:dell:latitude_3189_firmware:-:::::::*
dell	latitude_3390_2-in-1	Affected: 0 , < 1.31.0 (semver) cpe:2.3:h:dell:latitude_3390_2-in-1:-:::::::*
dell	latitude_5414_firmware	Affected: 0 , < 1.46.0 (semver) cpe:2.3:o:dell:latitude_5414_firmware:-:::::::*
dell	latitude_5424_firmware	Affected: 0 , < 1.32.0 (semver) cpe:2.3:a:dell:latitude_5424_firmware::::::::
dell	latitude_7414_rugged_extreme_firmware	Affected: 0 , < 1.46.0 (semver) cpe:2.3:o:dell:latitude_7414_rugged_extreme_firmware:-:::::::*
dell	precision_3420_tower	Affected: 0 , < 2.30.0 (semver) cpe:2.3:h:dell:precision_3420_tower:-:::::::*
dell	precision_3620_tower	Affected: 0 , < 2.30.0 (semver) cpe:2.3:h:dell:precision_3620_tower:-:::::::*
dell	latitude_5280_firmware	Affected: 0 , < 2.36.0 (semver) cpe:2.3:o:dell:latitude_5280_firmware:-:::::::*
dell	latitude_12_rugged_extreme_7214_firmware	Affected: 0 , < 1.46.0 (semver) cpe:2.3:o:dell:latitude_12_rugged_extreme_7214_firmware:-:::::::*
dell	latitude_3300_firmware	Affected: 0 , < 1.28.0 (semver) cpe:2.3:o:dell:latitude_3300_firmware:-:::::::*
dell	latitude_7212_rugged_extreme_tablet_firmware	Affected: 0 , < 1.50.0 (semver) cpe:2.3:a:dell:latitude_7212_rugged_extreme_tablet_firmware::::::::
dell	wyse_5070	Affected: 0 , < 1.31.0 (semver) cpe:2.3:h:dell:wyse_5070:-:::::::*

Date Public

2024-05-14 06:30

Credits

Dell would like to thank schur of BUPT, Dubhe Lab for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:dell:edge_gateway_3000_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "edge_gateway_3000_firmware",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.18.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:dell:latitude_13_3380:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "latitude_13_3380",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.27.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:dell:latitude_3180_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "latitude_3180_firmware",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.29.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:dell:latitude_3189_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "latitude_3189_firmware",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.29.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:dell:latitude_3390_2-in-1:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "latitude_3390_2-in-1",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.31.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:dell:latitude_5414_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "latitude_5414_firmware",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.46.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:dell:latitude_5424_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "latitude_5424_firmware",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.32.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:dell:latitude_7414_rugged_extreme_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "latitude_7414_rugged_extreme_firmware",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.46.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:dell:precision_3420_tower:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "precision_3420_tower",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "2.30.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:dell:precision_3620_tower:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "precision_3620_tower",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "2.30.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:dell:latitude_5280_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "latitude_5280_firmware",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "2.36.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:dell:latitude_12_rugged_extreme_7214_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "latitude_12_rugged_extreme_7214_firmware",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.46.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:dell:latitude_3300_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "latitude_3300_firmware",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.28.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:dell:latitude_7212_rugged_extreme_tablet_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "latitude_7212_rugged_extreme_tablet_firmware",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.50.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:dell:wyse_5070:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "wyse_5070",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "1.31.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T13:54:51.026876Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-06T14:03:23.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:43:35.008Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/kbdoc/en-us/000221102/dsa-2024-020"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPG BIOS",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "2.36.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            },
            {
              "lessThan": "1.46.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            },
            {
              "lessThan": "1.29.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            },
            {
              "lessThan": "1.28.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            },
            {
              "lessThan": "1.31.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            },
            {
              "lessThan": "1.32.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            },
            {
              "lessThan": "1.50.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            },
            {
              "lessThan": "2.30.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dell would like to thank schur of BUPT, Dubhe Lab for reporting this issue."
        }
      ],
      "datePublic": "2024-05-14T06:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to arbitrary code execution."
            }
          ],
          "value": "Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-17T15:20:16.147Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000221102/dsa-2024-020"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2024-22429",
    "datePublished": "2024-05-17T15:20:16.147Z",
    "dateReserved": "2024-01-10T15:23:01.337Z",
    "dateUpdated": "2024-08-01T22:43:35.008Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted