CVE-2023-43088

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Dell Client BIOS contains a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-16

Affected software

Vendor	Product	Versions
Dell	CPG BIOS	Versions prior to 1.5.0

References

https://www.dell.com/support/kbdoc/en-us/000218223/dsa-2023-377Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000218223/dsa-2023-377Vendor Advisory

Timeline

Published: Dec 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-430893.3Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malicious standard user co CVE-2023-43099.8Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities CVE-2023-430905.5A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked deskt CVE-2023-430919.8A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration CVE-2023-43109.8BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability whic CVE-2023-431026.1An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated CVE-2023-431036.1An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter. This is also fixed i CVE-2023-43118.8The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin sho CVE-2023-431145.5An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font en CVE-2023-431158.8In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because the CVE-2023-431167.8A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user t CVE-2023-431188.8Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.