What’s Vulnerable › Vulnerabilities

CVE-2024-0163

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-13 · updated 2026-06-17
• Weakness: CWE-367

Description

Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.

Affected products

• Dell Emc Xc Core Xc450 Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Emc Xc Core Xc650 Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Emc Xc Core Xc6520 Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Emc Xc Core Xc750 Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Emc Xc Core Xc750Xa Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Emc Xc Core Xc7525 Firmware: before 2.14.1 — fixed in 2.14.1
• Dell Poweredge C6520 Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Poweredge C6525 Firmware: before 2.14.1 — fixed in 2.14.1
• Dell Poweredge C6615 Firmware: before 1.2.3 — fixed in 1.2.3
• Dell Poweredge C6620 Firmware: before 2.0.0 — fixed in 2.0.0
• Dell Poweredge Hs5610 Firmware: before 2.0.0 — fixed in 2.0.0
• Dell Poweredge Hs5620 Firmware: before 2.0.0 — fixed in 2.0.0
• Dell Poweredge Mx750C Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Poweredge Mx760C Firmware: before 2.0.0 — fixed in 2.0.0
• Dell Poweredge R250 Firmware: before 1.9.1 — fixed in 1.9.1
• Dell Poweredge R350 Firmware: before 1.9.1 — fixed in 1.9.1
• Dell Poweredge R450 Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Poweredge R550 Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Poweredge R650 Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Poweredge R650Xs Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Poweredge R6515 Firmware: before 2.14.1 — fixed in 2.14.1
• Dell Poweredge R6525 Firmware: before 2.14.1 — fixed in 2.14.1
• Dell Poweredge R660 Firmware: before 2.0.0 — fixed in 2.0.0
• Dell Poweredge R660Xs Firmware: before 2.0.0 — fixed in 2.0.0
• Dell Poweredge R6615 Firmware: before 1.7.2 — fixed in 1.7.2
• Dell Poweredge R6625 Firmware: before 1.7.2 — fixed in 1.7.2
• Dell Poweredge R750 Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Poweredge R750Xa Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Poweredge R750Xs Firmware: before 1.13.2 — fixed in 1.13.2
• Dell Poweredge R7515 Firmware: before 2.14.1 — fixed in 2.14.1

How to fix

Upgrade to a fixed version: Dell Emc Xc Core Xc450 Firmware 1.13.2; Dell Emc Xc Core Xc650 Firmware 1.13.2; Dell Emc Xc Core Xc6520 Firmware 1.13.2; Dell Emc Xc Core Xc750 Firmware 1.13.2; Dell Emc Xc Core Xc750Xa Firmware 1.13.2; Dell Emc Xc Core Xc7525 Firmware 2.14.1; Dell Poweredge C6520 Firmware 1.13.2; Dell Poweredge C6525 Firmware 2.14.1; Dell Poweredge C6615 Firmware 1.2.3; Dell Poweredge C6620 Firmware 2.0.0; Dell Poweredge Hs5610 Firmware 2.0.0; Dell Poweredge Hs5620 Firmware 2.0.0. Check the vendor advisory for mitigations.

References

• https://www.dell.com/support/kbdoc/en-us/000222756/dsa-2024-003-security-update-for-dell-poweredge-server-bios-for-a-time-of-check-time-of-use-toctou-vulnerability
• https://www.dell.com/support/kbdoc/en-us/000222756/dsa-2024-003-security-update-for-dell-poweredge-server-bios-for-a-time-of-check-time-of-use-toctou-vulnerability

Get alerted when CVE-2024-0163 or the next vulnerability affects your stack