Read the docs
TI-2021-04641 Aliases CVE-2021-21556GHSA-9fc4-hxq5-hwj6

Stack-based buffer overflow in Dell PowerEdge BIOS Intel 15G

Priority LOW 29CWE-121Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a stack-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, arbitrary code execution, or information disclosure in UEFI or BIOS Preboot Environment.

Why it matters now

EPSS 0.00306 23rd percentileScored 2026-11-07
Fix Fixed PowerEdge BIOS Intel 15G (Dell): 2.11.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellPowerEdge BIOS Intel 15Gbefore 2.11.22.11.2Patch availableCNA
  • PowerEdge BIOS Intel 15G VendorDell Affected before 2.11.2 Fixed in 2.11.2 Patch available CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:o:dell:poweredge_r640_firmware:*:*:*:*:*:*:*:*before 2.11.2VulnerableDell
cpe:2.3:h:dell:poweredge_r640:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:poweredge_r740_firmware:*:*:*:*:*:*:*:*before 2.11.2VulnerableDell
cpe:2.3:h:dell:poweredge_r740:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:poweredge_r740xd_firmware:*:*:*:*:*:*:*:*before 2.11.2VulnerableDell
cpe:2.3:h:dell:poweredge_r740xd:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:poweredge_r940_firmware:*:*:*:*:*:*:*:*before 2.11.2VulnerableDell
cpe:2.3:h:dell:poweredge_r940:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:poweredge_r840_firmware:*:*:*:*:*:*:*:*before 2.11.2VulnerableDell
cpe:2.3:h:dell:poweredge_r840:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:poweredge_r640_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
  • cpe:2.3:h:dell:poweredge_r640:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:poweredge_r740_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
  • cpe:2.3:h:dell:poweredge_r740:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:poweredge_r740xd_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
  • cpe:2.3:h:dell:poweredge_r740xd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:poweredge_r940_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
  • cpe:2.3:h:dell:poweredge_r940:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:poweredge_r840_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
  • cpe:2.3:h:dell:poweredge_r840:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:dell:poweredge_r940xa_firmware:*:*:*:*:*:*:*:*before 2.11.2VulnerableDell
cpe:2.3:h:dell:poweredge_r940xa:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:poweredge_t640_firmware:*:*:*:*:*:*:*:*before 2.11.2VulnerableDell
cpe:2.3:h:dell:poweredge_t640:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:poweredge_mx740c_firmware:*:*:*:*:*:*:*:*before 2.11.2VulnerableDell
cpe:2.3:h:dell:poweredge_mx740c:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:poweredge_mx840c_firmware:*:*:*:*:*:*:*:*before 2.11.2VulnerableDell
cpe:2.3:h:dell:poweredge_mx840c:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:poweredge_r940xa_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
  • cpe:2.3:h:dell:poweredge_r940xa:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:poweredge_t640_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
  • cpe:2.3:h:dell:poweredge_t640:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:poweredge_mx740c_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
  • cpe:2.3:h:dell:poweredge_mx740c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:poweredge_mx840c_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
  • cpe:2.3:h:dell:poweredge_mx840c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA PowerEdge BIOS Intel 15G (Dell) Fixed in 2.11.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell PowerEdge BIOS Intel 15G 2.11.2

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2021-04642 Improper input validation in Dell PowerEdge BIOS Intel 15GPriority LOW 35
    • TI-2021-04640 Heap-based buffer overflow in Dell PowerEdge BIOS Intel 15GPriority LOW 29
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21556
  2. 2026-10-03 Alias added: GHSA-9fc4-hxq5-hwj6

References

Advisory 1

  • TI-2023-15743 Missing authentication in Dell PowerEdge Platform CVSS 3.1HIGH 8.8
  • TI-2024-00149 Improper input validation in Dell PowerEdge Platform CVSS 3.1HIGH 8.4
  • TI-2024-00160 Improper privilege management in Dell PowerEdge Platform CVSS 3.1HIGH 7.9
  • TI-2023-10842 Out-of-bounds write in Dell PowerEdge Platform CVSS 3.1HIGH 7.8
  • TI-2021-04642 Improper input validation in Dell PowerEdge BIOS Intel 15G CVSS 3.1HIGH 8.1
  • TI-2021-04639 Heap-based buffer overflow in Dell PowerEdge BIOS Intel 15G CVSS 3.1MEDIUM 6.7
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences