CVE-2024-0160 Missing authorization in CPG BIOS
An attacker with physical access can bypass BIOS authorization to modify system settings, requiring firmware updates to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0160?
CVE-2024-0160 is a medium-severity missing authorization vulnerability in Dell Inspiron 7500 Firmware, published on 12 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell Client Platform contains an incorrect authorization vulnerability. An attacker with physical access to the system could potentially exploit this vulnerability by bypassing BIOS authorization to modify settings in the BIOS.
Weakness: CWE-863
Which versions are affected by CVE-2024-0160?
It affects 15 products.
Products include Dell G3 3500 Firmware, Dell G5 5500 Firmware, Dell G7 7500 Firmware, Dell G7 7700 Firmware, Dell Inspiron 7500 Firmware, Dell Inspiron 7501 Firmware and 9 more.
How do I fix CVE-2024-0160?
No fix has been published for CVE-2024-0160 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-0160 being exploited?
There is no known exploitation of CVE-2024-0160 in the wild and no public exploit code.
Sources
Also known as GHSA-47wc-gh7x-58g7.