CVE-2023-28074 Information disclosure in Dell BSAFE Crypto-C Micro Edition

Medium 6.2 Published 31 Jul 2024 Updated 20 Aug 2024

An unauthenticated local attacker can exploit an out-of-bounds read in Dell BSAFE libraries to expose sensitive information.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-28074?

CVE-2023-28074 is a medium-severity vulnerability in Dell BSAFE Crypto-C Micro Edition, published on 31 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Dell BSAFE Crypto-C Micro Edition, version 4.1.5, and Dell BSAFE Micro Edition Suite, versions 4.0 through 4.6.1 and version 5.0, contains an Out-of-bounds Read vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

Weakness: CWE-125

Which versions are affected by CVE-2023-28074?

It affects 2 products.

Products include Dell Bsafe Crypto-C-Micro-Edition, Dell Bsafe Micro-Edition-Suite.

How do I fix CVE-2023-28074?

No fix has been published for CVE-2023-28074 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-28074 being exploited?

There is no known exploitation of CVE-2023-28074 in the wild and no public exploit code.

Sources

Also known as GHSA-75g8-qq4f-vwx8.