CVE-2024-38303

Severity: medium (CVSS 6.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-29 · updated 2026-06-17
Weakness: CWE-20

Description

Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Improper Input Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

Affected products

Dell Dss 8440 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Emc Storage Nx3240 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Emc Storage Nx3340 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Emc Xc Core 6420 System Firmware: before 2.22.2 — fixed in 2.22.2
Dell Emc Xc Core Xc640 System Firmware: before 2.22.2 — fixed in 2.22.2
Dell Emc Xc Core Xc740Xd2 Firmware: before 2.22.1 — fixed in 2.22.1
Dell Emc Xc Core Xc740Xd System Firmware: before 2.22.2 — fixed in 2.22.2
Dell Emc Xc Core Xc940 System Firmware: before 2.22.2 — fixed in 2.22.2
Dell Emc Xc Core Xcxr2 Firmware: before 2.22.1 — fixed in 2.22.1
Dell Poweredge C4140 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Poweredge C6420 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Poweredge Fc640 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Poweredge M640 (For Pe Vrtx) Firmware: before 2.22.2 — fixed in 2.22.2
Dell Poweredge M640 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Poweredge Mx740C Firmware: before 2.22.1 — fixed in 2.22.1
Dell Poweredge Mx840C Firmware: before 2.22.1 — fixed in 2.22.1
Dell Poweredge R440 Firmware: before 2.22.1 — fixed in 2.22.1
Dell Poweredge R540 Firmware: before 2.22.1 — fixed in 2.22.1
Dell Poweredge R640 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Poweredge R740 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Poweredge R740Xd2 Firmware: before 2.22.1 — fixed in 2.22.1
Dell Poweredge R740Xd Firmware: before 2.22.2 — fixed in 2.22.2
Dell Poweredge R840 Firmware: before 2.22.1 — fixed in 2.22.1
Dell Poweredge R940 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Poweredge R940Xa Firmware: before 2.22.1 — fixed in 2.22.1
Dell Poweredge T440 Firmware: before 2.22.1 — fixed in 2.22.1
Dell Poweredge T640 Firmware: before 2.22.1 — fixed in 2.22.1
Dell Poweredge Xe2420 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Poweredge Xe7420 Firmware: before 2.22.2 — fixed in 2.22.2
Dell Poweredge Xe7440 Firmware: before 2.22.2 — fixed in 2.22.2

How to fix

Upgrade to a fixed version: Dell Dss 8440 Firmware 2.22.2; Dell Emc Storage Nx3240 Firmware 2.22.2; Dell Emc Storage Nx3340 Firmware 2.22.2; Dell Emc Xc Core 6420 System Firmware 2.22.2; Dell Emc Xc Core Xc640 System Firmware 2.22.2; Dell Emc Xc Core Xc740Xd2 Firmware 2.22.1; Dell Emc Xc Core Xc740Xd System Firmware 2.22.2; Dell Emc Xc Core Xc940 System Firmware 2.22.2; Dell Emc Xc Core Xcxr2 Firmware 2.22.1; Dell Poweredge C4140 Firmware 2.22.2; Dell Poweredge C6420 Firmware 2.22.2; Dell Poweredge Fc640 Firmware 2.22.2. Check the vendor advisory for mitigations.

References

https://www.dell.com/support/kbdoc/en-us/000228135/dsa-2024-309-security-update-for-dell-poweredge-server-for-improper-input-validation-vulnerability

Get alerted when CVE-2024-38303 or the next vulnerability affects your stack