CVE-2023-32475 Security feature bypass in CPG BIOS
An attacker with physical access can bypass integrity checks in Dell BIOS to execute arbitrary code on the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32475?
CVE-2023-32475 is a high-severity vulnerability in Dell CPG BIOS, published on 7 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell BIOS contains a missing support for integrity check vulnerability. An attacker with physical access to the system could potentially bypass security mechanisms to run arbitrary code on the system.
Weakness: CWE-353
Which versions are affected by CVE-2023-32475?
It affects 40 products.
Products include Dell Alienware Aurora R10 Firmware, Dell Alienware Aurora R15 Amd Firmware, Dell Alienware Aurora Ryzen Edition R14 Firmware, Dell Alienware M15 R7 Amd Firmware, Dell Alienware M15 Ryzen Edition R5 Firmware, Dell Alienware M16 R1 Amd Firmware and 34 more.
How do I fix CVE-2023-32475?
No fix has been published for CVE-2023-32475 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-32475 being exploited?
There is no known exploitation of CVE-2023-32475 in the wild and no public exploit code.
Sources
Also known as GHSA-c54f-vgc6-pc5x.