Improper input validation in Dell PowerEdge BIOS Intel 15G
Priority LOW 35CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of service, arbitrary code execution, or information disclosure in System Management Mode.
Why it matters now
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Fixed PowerEdge BIOS Intel 15G (Dell): 2.11.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | PowerEdge BIOS Intel 15G | before 2.11.2 | 2.11.2 | Patch available | CNA |
- PowerEdge BIOS Intel 15G VendorDell Affected before 2.11.2 Fixed in 2.11.2 Patch available CNA
CPE configurations NVD · 62
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:poweredge_r640_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r640:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r740_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r740:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r740xd_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r740xd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r940_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r940:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r540_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:poweredge_r640_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r640:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r740_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r740:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r740xd_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r740xd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r940_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r940:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r540_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Show 52 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:poweredge_r440_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_t440_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_t440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_xr2_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_xr2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r740xd2_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r740xd2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r840_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r840:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r940xa_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r940xa:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_t640_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_t640:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_c6420_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_c6420:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_fc640_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_fc640:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_m640_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_m640:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_m640p_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_m640p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_mx740c_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_mx740c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_mx840c_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_mx840c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_c4140_firmware:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_c4140:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_t140_firmware:*:*:*:*:*:*:*:* | before 2.5.1 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_t140:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_t340_firmware:*:*:*:*:*:*:*:* | before 2.5.1 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_t340:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r240_firmware:*:*:*:*:*:*:*:* | before 2.5.1 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r240:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r340_firmware:*:*:*:*:*:*:*:* | before 2.5.1 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r340:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r6415_firmware:*:*:*:*:*:*:*:* | before 1.16.1 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r6415:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r7415_firmware:*:*:*:*:*:*:*:* | before 1.16.1 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r7415:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r7425_firmware:*:*:*:*:*:*:*:* | before 1.16.1 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r7425:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r6515_firmware:*:*:*:*:*:*:*:* | before 2.2.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r6515:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r7515_firmware:*:*:*:*:*:*:*:* | before 2.2.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r7515:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r6525_firmware:*:*:*:*:*:*:*:* | before 2.2.5 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r6525:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_r7525_firmware:*:*:*:*:*:*:*:* | before 2.2.5 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_r7525:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:o:dell:poweredge_c6525_firmware:*:*:*:*:*:*:*:* | before 2.2.4 | Vulnerable | Dell |
| cpe:2.3:h:dell:poweredge_c6525:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:poweredge_r440_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_t440_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_t440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_xr2_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_xr2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r740xd2_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r740xd2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r840_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r840:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r940xa_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r940xa:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_t640_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_t640:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_c6420_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_c6420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_fc640_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_fc640:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_m640_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_m640:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_m640p_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_m640p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_mx740c_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_mx740c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_mx840c_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_mx840c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_c4140_firmware:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_c4140:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_t140_firmware:*:*:*:*:*:*:*:* Versions before 2.5.1 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_t140:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_t340_firmware:*:*:*:*:*:*:*:* Versions before 2.5.1 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_t340:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r240_firmware:*:*:*:*:*:*:*:* Versions before 2.5.1 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r240:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r340_firmware:*:*:*:*:*:*:*:* Versions before 2.5.1 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r340:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r6415_firmware:*:*:*:*:*:*:*:* Versions before 1.16.1 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r6415:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r7415_firmware:*:*:*:*:*:*:*:* Versions before 1.16.1 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r7415:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r7425_firmware:*:*:*:*:*:*:*:* Versions before 1.16.1 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r7425:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r6515_firmware:*:*:*:*:*:*:*:* Versions before 2.2.4 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r6515:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r7515_firmware:*:*:*:*:*:*:*:* Versions before 2.2.4 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r7515:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r6525_firmware:*:*:*:*:*:*:*:* Versions before 2.2.5 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r6525:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_r7525_firmware:*:*:*:*:*:*:*:* Versions before 2.2.5 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_r7525:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:o:dell:poweredge_c6525_firmware:*:*:*:*:*:*:*:* Versions before 2.2.4 Vulnerable ·Dell
- cpe:2.3:h:dell:poweredge_c6525:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Remediation
- Fix · CNA PowerEdge BIOS Intel 15G (Dell) Fixed in 2.11.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Dell PowerEdge BIOS Intel 15G 2.11.2
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2021-04641 Stack-based buffer overflow in Dell PowerEdge BIOS Intel 15GPriority LOW 29
- TI-2021-04640 Heap-based buffer overflow in Dell PowerEdge BIOS Intel 15GPriority LOW 29
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21557
- 2026-10-03 Alias added: GHSA-66g6-48gr-pwpc
References
More Dell Poweredge C4140 Firmware vulnerabilities
- TI-2023-15743 Missing authentication in Dell PowerEdge Platform CVSS 3.1HIGH 8.8
- TI-2024-00149 Improper input validation in Dell PowerEdge Platform CVSS 3.1HIGH 8.4
- TI-2024-00160 Improper privilege management in Dell PowerEdge Platform CVSS 3.1HIGH 7.9
- TI-2023-10842 Out-of-bounds write in Dell PowerEdge Platform CVSS 3.1HIGH 7.8
- TI-2024-25578 Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of… CVSS 3.1MEDIUM 6.5
- TI-2024-25577 Improper input validation in Dell PowerEdge Platform CVSS 3.1MEDIUM 6.0
Sources
- CVE-2021-21557 · CVE Program
- CVE-2021-21557 · NVD
- FIRST EPSS
- GHSA-66g6-48gr-pwpc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences