CVE-2022-26863 Security feature bypass in CPG BIOS
A local attacker can bypass System Management Mode security controls by sending malicious input to an SMI in Dell BIOS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-26863?
CVE-2022-26863 is a medium-severity vulnerability in Dell CPG BIOS, published on 23 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.
Weakness: CWE-20
Which versions are affected by CVE-2022-26863?
It affects 34 products.
Products include Dell Alienware M15 R5 Firmware, Dell G15 5515 Firmware, Dell G5 Se 5505 Firmware, Dell Inspiron 14 5425 Firmware, Dell Inspiron 27 7775 Firmware, Dell Inspiron 3180 Firmware and 28 more.
How do I fix CVE-2022-26863?
No fix has been published for CVE-2022-26863 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-26863 being exploited?
There is no known exploitation of CVE-2022-26863 in the wild and no public exploit code.
Other vulnerabilities in Dell CPG BIOS
Sources
Also known as GHSA-5g2w-hp6q-gjv2.