What’s Vulnerable › Vulnerabilities
CVE-2023-28075
- Severity: medium (CVSS 6.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2023-08-16 · updated 2026-06-17
- Weakness: CWE-367
Description
Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. A local authenticated malicious user with physical access to the system could potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI in order to gain arbitrary code execution on the system.
Affected products
- Dell Alienware M15 R7 Firmware: before 1.18.0 — fixed in 1.18.0
- Dell Alienware M16 Firmware: before 1.10.1 — fixed in 1.10.1
- Dell Alienware M18 Firmware: before 1.10.1 — fixed in 1.10.1
- Dell Chengming 3900 Firmware: before 1.15.0 — fixed in 1.15.0
- Dell Chengming 3901 Firmware: before 1.15.0 — fixed in 1.15.0
- Dell Chengming 3910 Firmware: before 1.6.0 — fixed in 1.6.0
- Dell Chengming 3911 Firmware: before 1.6.0 — fixed in 1.6.0
- Dell Chengming 3980 Firmware: before 2.32.0 — fixed in 2.32.0
- Dell Chengming 3990 Firmware: before 1.21.0 — fixed in 1.21.0
- Dell Chengming 3991 Firmware: before 1.21.0 — fixed in 1.21.0
- Dell Edge Gateway 3000 Firmware: before 1.13.0 — fixed in 1.13.0
- Dell Edge Gateway 5000 Firmware: before 1.23.0 — fixed in 1.23.0
- Dell Embedded Box PC 3000 , CPG BIOS: before 1.19.0 — fixed in 1.19.0
- Dell Embedded Box Pc 5000 Firmware: before 1.20.0 — fixed in 1.20.0
- Dell G15 5520 Firmware: before 1.18.0 — fixed in 1.18.0
- Dell G16 7620 Firmware: before 1.18.0 — fixed in 1.18.0
- Dell G3 3500 Firmware: before 1.26.0 — fixed in 1.26.0
- Dell G5 15 5500 Firmware: before 1.26.0 — fixed in 1.26.0
- Dell G5 15 5590 Firmware: before 1.26.0 — fixed in 1.26.0
- Dell G7 15 7500 Firmware: before 1.26.0 — fixed in 1.26.0
- Dell G7 15 7590 Firmware: before 1.26.0 — fixed in 1.26.0
- Dell G7 17 7700 Firmware: before 1.26.0 — fixed in 1.26.0
- Dell G7 17 7790 Firmware: before 1.26.0 — fixed in 1.26.0
- Dell Inspiron 14 5410 Firmware: before 2.20.0 — fixed in 2.20.0
- Dell Inspiron 14 5418 Firmware: before 2.20.0 — fixed in 2.20.0
- Dell Inspiron 15 3511 Firmware: before 1.23.0 — fixed in 1.23.0
- Dell Inspiron 15 5510 Firmware: before 2.20.0 — fixed in 2.20.0
- Dell Inspiron 15 5518 Firmware: before 2.20.0 — fixed in 2.20.0
- Dell Inspiron 24 5420 All-In-One Firmware: before 1.4.0 — fixed in 1.4.0
- Dell Inspiron 24 5421 All-In-One Firmware: before 1.4.0 — fixed in 1.4.0
How to fix
Upgrade to a fixed version: Dell Alienware M15 R7 Firmware 1.18.0; Dell Alienware M16 Firmware 1.10.1; Dell Alienware M18 Firmware 1.10.1; Dell Chengming 3900 Firmware 1.15.0; Dell Chengming 3901 Firmware 1.15.0; Dell Chengming 3910 Firmware 1.6.0; Dell Chengming 3911 Firmware 1.6.0; Dell Chengming 3980 Firmware 2.32.0; Dell Chengming 3990 Firmware 1.21.0; Dell Chengming 3991 Firmware 1.21.0; Dell Edge Gateway 3000 Firmware 1.13.0; Dell Edge Gateway 5000 Firmware 1.23.0. Check the vendor advisory for mitigations.
References
- https://www.dell.com/support/kbdoc/en-us/000212817/dsa-2023-152-security-update-for-a-dell-client-bios-vulnerability
- https://www.dell.com/support/kbdoc/en-us/000212817/dsa-2023-152-security-update-for-a-dell-client-bios-vulnerability
Get alerted when CVE-2023-28075 or the next vulnerability affects your stack