What’s Vulnerable › Vulnerabilities

CVE-2023-28040

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-23 · updated 2026-06-17
• Weakness: CWE-20

Description

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

Affected products

• Dell Alienware Area 51M R1 Firmware: before 1.26.0 — fixed in 1.26.0
• Dell Alienware Area 51M R2 Firmware: before 1.22.0 — fixed in 1.22.0
• Dell Alienware Aurora R11 Firmware: before 1.0.20 — fixed in 1.0.20
• Dell Alienware Aurora R12 Firmware: before 1.1.20 — fixed in 1.1.20
• Dell Alienware Aurora R13 Firmware: before 1.12.0 — fixed in 1.12.0
• Dell Alienware Aurora R15 Firmware: before 1.1.0 — fixed in 1.1.0
• Dell Alienware M15 R2 Firmware: before 1.22.0 — fixed in 1.22.0
• Dell Alienware M15 R3 Firmware: before 1.23.0 — fixed in 1.23.0
• Dell Alienware M15 R4 Firmware: before 1.17.0 — fixed in 1.17.0
• Dell Alienware M15 R6 Firmware: before 1.21.0 — fixed in 1.21.0
• Dell Alienware M15 R7 Firmware: before 1.16.0 — fixed in 1.16.0
• Dell Alienware M16 Firmware: before 1.7.0 — fixed in 1.7.0
• Dell Alienware M17 R2 Firmware: before 1.22.0 — fixed in 1.22.0
• Dell Alienware M17 R3 Firmware: before 1.23.0 — fixed in 1.23.0
• Dell Alienware M17 R4 Firmware: before 1.17.0 — fixed in 1.17.0
• Dell Alienware X14 Firmware: before 1.12.0 — fixed in 1.12.0
• Dell Alienware X15 R1 Firmware: before 1.18.0 — fixed in 1.18.0
• Dell Alienware X15 R2 Firmware: before 1.13.0 — fixed in 1.13.0
• Dell Alienware X17 R1 Firmware: before 1.18.0 — fixed in 1.18.0
• Dell Alienware X17 R2 Firmware: before 1.13.0 — fixed in 1.13.0
• Dell Chengming 3900 Firmware: before 1.11.0 — fixed in 1.11.0
• Dell Chengming 3901 Firmware: before 1.11.0 — fixed in 1.11.0
• Dell Chengming 3910 Firmware: before 1.1.0 — fixed in 1.1.0
• Dell Chengming 3911 Firmware: before 1.1.0 — fixed in 1.1.0
• Dell Chengming 3980 Firmware: before 2.29.0 — fixed in 2.29.0
• Dell Chengming 3988 Firmware: before 1.15.0 — fixed in 1.15.0
• Dell Chengming 3990 Firmware: before 1.19.0 — fixed in 1.19.0
• Dell Chengming 3991 Firmware: before 1.19.0 — fixed in 1.19.0
• Dell Embedded Box Pc 5000 Firmware: before 1.19.0 — fixed in 1.19.0
• Dell G15 5510 Firmware: before 1.19.0 — fixed in 1.19.0

How to fix

Upgrade to a fixed version: Dell Alienware Area 51M R1 Firmware 1.26.0; Dell Alienware Area 51M R2 Firmware 1.22.0; Dell Alienware Aurora R11 Firmware 1.0.20; Dell Alienware Aurora R12 Firmware 1.1.20; Dell Alienware Aurora R13 Firmware 1.12.0; Dell Alienware Aurora R15 Firmware 1.1.0; Dell Alienware M15 R2 Firmware 1.22.0; Dell Alienware M15 R3 Firmware 1.23.0; Dell Alienware M15 R4 Firmware 1.17.0; Dell Alienware M15 R6 Firmware 1.21.0; Dell Alienware M15 R7 Firmware 1.16.0; Dell Alienware M16 Firmware 1.7.0. Check the vendor advisory for mitigations.

References

• https://www.dell.com/support/kbdoc/en-us/000212204/dsa-2023-099-dell-client-bios-security-update-for-multiple-improper-input-validation-vulnerabilities
• https://www.dell.com/support/kbdoc/en-us/000212204/dsa-2023-099-dell-client-bios-security-update-for-multiple-improper-input-validation-vulnerabilities

Get alerted when CVE-2023-28040 or the next vulnerability affects your stack