What’s Vulnerable › Vulnerabilities

CVE-2023-25537

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-22 · updated 2026-06-17
• Weakness: CWE-787

Description

Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability. A local attacker with low privileges could potentially exploit this vulnerability leading to exposure of some SMRAM stack/data/code in System Management Mode, leading to arbitrary code execution or escalation of privilege.

Affected products

• Dell Dss 8440 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Emc Storage Nx3240 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Emc Storage Nx3340 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Emc Xc Core 6420 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Emc Xc Core Xc640 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Emc Xc Core Xc740Xd2 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Emc Xc Core Xc740Xd Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Emc Xc Core Xc940 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Emc Xc Core Xcxr2 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge C4140 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge C6420 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge Fc640 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge M640 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge Mx740C Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge Mx840C Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge R440 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge R540 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge R640 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge R740 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge R740Xd2 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge R740Xd Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge R840 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge R940 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge R940Xa Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge T440 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge T640 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge Xe2420 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge Xe7420 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge Xe7440 Firmware: before 2.18.1 — fixed in 2.18.1
• Dell Poweredge Xr2 Firmware: before 2.18.1 — fixed in 2.18.1

How to fix

Upgrade to a fixed version: Dell Dss 8440 Firmware 2.18.1; Dell Emc Storage Nx3240 Firmware 2.18.1; Dell Emc Storage Nx3340 Firmware 2.18.1; Dell Emc Xc Core 6420 Firmware 2.18.1; Dell Emc Xc Core Xc640 Firmware 2.18.1; Dell Emc Xc Core Xc740Xd2 Firmware 2.18.1; Dell Emc Xc Core Xc740Xd Firmware 2.18.1; Dell Emc Xc Core Xc940 Firmware 2.18.1; Dell Emc Xc Core Xcxr2 Firmware 2.18.1; Dell Poweredge C4140 Firmware 2.18.1; Dell Poweredge C6420 Firmware 2.18.1; Dell Poweredge Fc640 Firmware 2.18.1. Check the vendor advisory for mitigations.

References

• https://www.dell.com/support/kbdoc/en-us/000213550/dsa-2023-098-security-update-for-dell-poweredge-14g-server-bios-for-an-out-of-bounds-write-vulnerability
• https://www.dell.com/support/kbdoc/en-us/000213550/dsa-2023-098-security-update-for-dell-poweredge-14g-server-bios-for-an-out-of-bounds-write-vulnerability

Get alerted when CVE-2023-25537 or the next vulnerability affects your stack