CVE-2022-22566

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Select Dell Client Commercial and Consumer platforms contain a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1190

Affected software

Vendor	Product	Versions
Dell	CPG BIOS	>= unspecified, < 1.15

References

https://www.dell.com/support/kbdoc/en-us/000195905/dsa-2022-028Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000195905/dsa-2022-028Vendor Advisory

Timeline

Published: Feb 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-225675.1Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticity vulnerability. An a CVE-2022-22577.8Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.CVE-2022-2257010.0A buffer overflow vulnerability found in the UniFi Door Access Reader Lite’s (UA Lite) firmware (Version 3.8.28.24 and earlier) allows a mal CVE-2022-225714.8An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all CVE-2022-225728.8A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerabilit CVE-2022-225768.1An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connecti CVE-2022-225776.1An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.CVE-2022-225787.8A logic issue was addressed with improved validation. This issue is fixed in tvOS 15.3, iOS 15.3 and iPadOS 15.3, watchOS 8.4, macOS Montere CVE-2022-225797.8An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS 15.3, tvOS 15.3, Se CVE-2022-22584.3In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these CVE-2022-225825.5A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed i CVE-2022-225835.5A permissions issue was addressed with improved validation. This issue is fixed in Security Update 2022-001 Catalina, macOS Monterey 12.2, m