Dell BIOS contains an improper input validation vulnerability.

published 2023-06-23 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-31767

cvss: 5.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits: 0; none known

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

Patch / fix

fixed in 20

dell alienware_area_51m_r1_firmware 1.26.0
dell alienware_area_51m_r2_firmware 1.22.0
dell alienware_aurora_r11_firmware 1.0.20
dell alienware_aurora_r12_firmware 1.1.20
dell alienware_aurora_r13_firmware 1.12.0
dell alienware_aurora_r15_firmware 1.1.0
dell alienware_m15_r2_firmware 1.22.0
dell alienware_m15_r3_firmware 1.23.0
dell alienware_m15_r4_firmware 1.17.0
dell alienware_m15_r6_firmware 1.21.0
dell alienware_m15_r7_firmware 1.16.0
dell alienware_m16_firmware 1.7.0
dell alienware_m17_r2_firmware 1.22.0
dell alienware_m17_r3_firmware 1.23.0
dell alienware_m17_r4_firmware 1.17.0
dell alienware_x14_firmware 1.12.0
dell alienware_x15_r1_firmware 1.18.0
dell alienware_x15_r2_firmware 1.13.0
dell alienware_x17_r1_firmware 1.18.0
dell alienware_x17_r2_firmware 1.13.0

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-11-08)

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.1	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
NVD	3.1	6.7	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Dell CPG BIOS

Classification

Weakness

CWE-20 Improper Input Validation

References

dell.com /support/kbdoc/en-us/000212204/dsa-2023-099-dell-client-bios-security-update-for-multiple-improper-input-valid
vendor-advisory

Sources

CVE List CVE-2023-28042
NVD CVE-2023-28042

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary