CVE-2024-0158

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability to modify a UEFI variable, leading to denial of service and escalation of privileges

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Dell	CPG BIOS	>= N/A, < 1.28.0; >= N/A, < 1.23.0; >= N/A, < 1.15.0; >= N/A, < 1.2.1; >= N/A, < 1.12.1; >= N/A, < 1.2.0; >= N/A, < 1.20.0; >= N/A, < 1.12.0; >= N/A, < 1.26.0; >= N/A, < 1.27.0; >= N/A, < 1.13.0; >= N/A, < 1.29.0; >= N/A, < 1.19.0; >= N/A, < 1.25.0; >= N/A, < 1.31.0; >= N/A, < 2.27.0; >= N/A, < 2.35.0; >= N/A, < 2.39.0; >= N/A, < 1.17.0; >= N/A, < 1.24.0

References

Timeline

Published: Jul 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-01595.5Dell Alienware Command Center, versions 5.5.52.0 and prior, contain improper access control vulnerability, leading to Denial of Service on l CVE-2024-01606.8Dell Client Platform contains an incorrect authorization vulnerability. An attacker with physical access to the system could potentially exp CVE-2024-01618.4Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low CVE-2024-01628.8Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low CVE-2024-01636.3Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could CVE-2024-01647.8Dell Unity, versions prior to 5.4, contain an OS Command Injection Vulnerability in its svc_topstats utility. An authenticated attacker coul CVE-2024-01657.8Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_acldb_dump utility. An authenticated attacker c CVE-2024-01667.8Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_tcpdump utility. An authenticated attacker coul CVE-2024-01677.8Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svc_topstats utility. An authenticated attacker cou CVE-2024-01687.8Dell Unity, versions prior to 5.4, contains a Command Injection Vulnerability in svc_oscheck utility. An authenticated attacker could potent CVE-2024-01695.4Dell Unity, version(s) 5.3 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vul CVE-2024-01707.8Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cava utility. An authenticated attacker could p