Vulnerability · Published Jun 12, 2024 · Assigned by dell

CVE-2024-28970

Medium 4.7

In plain English

A medium-severity out-of-bounds write in CPG BIOS from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.1%top 96.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dell Client BIOS contains an Out-of-bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to platform denial of service.

Affected products (as reported)

Vendor	Product	Versions
Dell	CPG BIOS	N/A – before 1.32.0N/A – before 1.6.0N/A – before 1.4.0N/A – before 1.11.0N/A – before 1.30.0N/A – before 2.14.0

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

References

https://www.dell.com/support/kbdoc/en-us/000225476/dsa-2024-168 vendor-advisory