Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS.

published 2023-08-16 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-31800

cvss: 6.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits: 0; none known

Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. A local authenticated malicious user with physical access to the system could potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI in order to gain arbitrary code execution on the system.

Patch / fix

fixed in 20

dell alienware_m15_r7_firmware 1.18.0
dell alienware_m16_firmware 1.10.1
dell alienware_m18_firmware 1.10.1
dell chengming_3900_firmware 1.15.0
dell chengming_3901_firmware 1.15.0
dell chengming_3910_firmware 1.6.0
dell chengming_3911_firmware 1.6.0
dell chengming_3980_firmware 2.32.0
dell chengming_3990_firmware 1.21.0
dell chengming_3991_firmware 1.21.0
dell g15_5520_firmware 1.18.0
dell g16_7620_firmware 1.18.0
dell g3_3500_firmware 1.26.0
dell g5_15_5500_firmware 1.26.0
dell g5_15_5590_firmware 1.26.0
dell g7_15_7500_firmware 1.26.0
dell g7_15_7590_firmware 1.26.0
dell g7_17_7700_firmware 1.26.0
dell g7_17_7790_firmware 1.26.0
dell precision_5680_firmware 1.4.1

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-10-08)

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.9	CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	6.3	CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Dell CPG BIOS
dell cpg_bios

Classification

Weakness

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

dell.com /support/kbdoc/en-us/000212817/dsa-2023-152-security-update-for-a-dell-client-bios-vulnerability
vendor-advisory

Sources

CVE List CVE-2023-28075
NVD CVE-2023-28075

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary