CVE-2024-22429

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to arbitrary code execution.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Dell	CPG BIOS	>= N/A, < 2.36.0; >= N/A, < 1.18.0; >= N/A, < 1.46.0; >= N/A, < 1.27.0; >= N/A, < 1.29.0; >= N/A, < 1.28.0; >= N/A, < 1.31.0; >= N/A, < 1.32.0; >= N/A, < 1.50.0; >= N/A, < 2.30.0
dell	edge_gateway_3000_firmware	< 1.18.0
dell	latitude_13_3380	< 1.27.0
dell	latitude_3180_firmware	< 1.29.0
dell	latitude_3189_firmware	< 1.29.0
dell	latitude_3390_2-in-1	< 1.31.0
dell	latitude_5414_firmware	< 1.46.0
dell	latitude_5424_firmware	< 1.32.0
dell	latitude_7414_rugged_extreme_firmware	< 1.46.0
dell	precision_3420_tower	< 2.30.0
dell	precision_3620_tower	< 2.30.0
dell	latitude_5280_firmware	< 2.36.0
dell	latitude_12_rugged_extreme_7214_firmware	< 1.46.0
dell	latitude_3300_firmware	< 1.28.0
dell	latitude_7212_rugged_extreme_tablet_firmware	< 1.50.0
dell	wyse_5070	< 1.31.0

References

https://www.dell.com/support/kbdoc/en-us/000221102/dsa-2024-020Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000221102/dsa-2024-020Vendor Advisory

Timeline

Published: May 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-22438.8A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability CVE-2024-224305.5Dell PowerScale OneFS versions 8.2.x through 9.6.0.x contains an incorrect default permissions vulnerability. A local low privileges malicio CVE-2024-224326.5Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Da CVE-2024-224339.8Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in CVE-2024-224358.3A potential security vulnerability has been identified in Web ViewPoint Enterprise software. This vulnerability could be exploited to allow CVE-2024-224366.5A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a denial of service.CVE-2024-224377.3A potential security vulnerability has been identified in VSS Provider and CAPI Proxy software for certain HPE MSA storage products. This vu CVE-2024-224383.5A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820 Network switches. The vulnerability CVE-2024-224396.9A potential security vulnerability has been identified in HPE FlexFabric and FlexNetwork series products. This vulnerability could be exploi CVE-2024-22445.3REST service authentication anomaly with “valid username/no password” credential combination for batch job processing resulting in successfu CVE-2024-224406.8A potential security vulnerability has been identified in HPE Compute Scale-up Server 3200 server. This vulnerability could cause disclosure CVE-2024-224419.8HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass.