CVE-2024-38483

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Dell BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Dell	Dell Client Platform BIOS	>= N/A, < 1.35.0; >= N/A, < 2.32.0; >= N/A, < 1.26.0
dell	latitude_5290_2-in-1_firmware	< 1.35.0
dell	precision_3420_tower_firmware	< 2.32.0
dell	precision_3620_tower_firmware	< 2.32.0
dell	wyse_7040_thin_client_firmware	< 1.26.0

References

https://www.dell.com/support/kbdoc/en-us/000225776/dsa-2024-260Vendor Advisory

Timeline

Published: Aug 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-384854.3Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially expl CVE-2024-384868.8Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special Elemen CVE-2024-384877.0api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintend CVE-2024-384889.8Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability whe CVE-2024-384894.4Dell iDRAC Service Module version 5.3.0.0 and prior contains Out of bound write Vulnerability. A privileged local attacker could execute arb CVE-2024-38498.8The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This m CVE-2024-384904.4Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. A privileged local attacker could execute a CVE-2024-384918.4The vulnerability allows an unauthenticated attacker to read arbitrary information from the database.CVE-2024-384929.4This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a speciall CVE-2024-384936.1A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to cl CVE-2024-384948.6This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending CVE-2024-384955.3A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database.