Read the docs
TI-2022-08293 Aliases CVE-2022-24417GHSA-mcfm-qpjr-xxm3

Improper input validation in Dell CPG BIOS

Priority LOW 32CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.

Why it matters now

EPSS 0.00248 16th percentileScored 2026-11-07
Fix Fixed CPG BIOS (Dell): 1.10.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellCPG BIOSbefore 1.10.01.10.0Patch availableCNA
  • CPG BIOS VendorDell Affected before 1.10.0 Fixed in 1.10.0 Patch available CNA

CPE configurations NVD · 56

CPEVersionsRoleVendor
cpe:2.3:o:dell:dell_g5_5505_firmware:*:*:*:*:*:*:*:*before 1.10.0VulnerableDell
cpe:2.3:h:dell:dell_g5_5505:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_22-3275_firmware:*:*:*:*:*:*:*:*before 1.8.0VulnerableDell
cpe:2.3:h:dell:inspiron_22-3275:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_24-3475_firmware:*:*:*:*:*:*:*:*before 1.8.0VulnerableDell
cpe:2.3:h:dell:inspiron_24-3475:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_27_7775_firmware:*:*:*:*:*:*:*:*before 2.15.0VulnerableDell
cpe:2.3:h:dell:inspiron_27_7775:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_3180_firmware:*:*:*:*:*:*:*:*before 1.4.4VulnerableDell
cpe:2.3:h:dell:inspiron_3180:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:dell_g5_5505_firmware:*:*:*:*:*:*:*:* Versions before 1.10.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:dell_g5_5505:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_22-3275_firmware:*:*:*:*:*:*:*:* Versions before 1.8.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_22-3275:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_24-3475_firmware:*:*:*:*:*:*:*:* Versions before 1.8.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_24-3475:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_27_7775_firmware:*:*:*:*:*:*:*:* Versions before 2.15.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_27_7775:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_3180_firmware:*:*:*:*:*:*:*:* Versions before 1.4.4 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_3180:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Show 46 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:dell:inspiron_3185_firmware:*:*:*:*:*:*:*:*before 1.4.4VulnerableDell
cpe:2.3:h:dell:inspiron_3185:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_3195_firmware:*:*:*:*:*:*:*:*before 1.4.1VulnerableDell
cpe:2.3:h:dell:inspiron_3195:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_3505_firmware:*:*:*:*:*:*:*:*before 1.5.0VulnerableDell
cpe:2.3:h:dell:inspiron_3505:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_3515_firmware:*:*:*:*:*:*:*:*before 1.4.0VulnerableDell
cpe:2.3:h:dell:inspiron_3515:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_3585_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:inspiron_3585:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_3595_firmware:*:*:*:*:*:*:*:*before 1.2.1VulnerableDell
cpe:2.3:h:dell:inspiron_3595:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_3785_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:inspiron_3785:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5405_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:inspiron_5405:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5415_firmware:*:*:*:*:*:*:*:*before 1.7.1VulnerableDell
cpe:2.3:h:dell:inspiron_5415:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5485_firmware:*:*:*:*:*:*:*:*before 2.7.0VulnerableDell
cpe:2.3:h:dell:inspiron_5485:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5505_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:inspiron_5505:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5515_firmware:*:*:*:*:*:*:*:*before 1.7.1VulnerableDell
cpe:2.3:h:dell:inspiron_5515:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5575_firmware:*:*:*:*:*:*:*:*before 1.5.0VulnerableDell
cpe:2.3:h:dell:inspiron_5575:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5585_firmware:*:*:*:*:*:*:*:*before 2.7.0VulnerableDell
cpe:2.3:h:dell:inspiron_5585:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5675_firmware:*:*:*:*:*:*:*:*before 1.5.0VulnerableDell
cpe:2.3:h:dell:inspiron_5675:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5775_firmware:*:*:*:*:*:*:*:*before 1.5.0VulnerableDell
cpe:2.3:h:dell:inspiron_5775:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_7375_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:inspiron_7375:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_7405_firmware:*:*:*:*:*:*:*:*before 1.7.0VulnerableDell
cpe:2.3:h:dell:inspiron_7405:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_7415_firmware:*:*:*:*:*:*:*:*before 1.7.1VulnerableDell
cpe:2.3:h:dell:inspiron_7415:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_3405_firmware:*:*:*:*:*:*:*:*before 1.5.0VulnerableDell
cpe:2.3:h:dell:vostro_3405:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_3515_firmware:*:*:*:*:*:*:*:*before 1.4.0VulnerableDell
cpe:2.3:h:dell:vostro_3515:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_5415_firmware:*:*:*:*:*:*:*:*before 1.7.1VulnerableDell
cpe:2.3:h:dell:vostro_5415:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_5515_firmware:*:*:*:*:*:*:*:*before 1.7.1VulnerableDell
cpe:2.3:h:dell:vostro_5515:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:inspiron_3185_firmware:*:*:*:*:*:*:*:* Versions before 1.4.4 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_3185:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_3195_firmware:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_3195:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_3505_firmware:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_3505:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_3515_firmware:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_3515:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_3585_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_3585:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_3595_firmware:*:*:*:*:*:*:*:* Versions before 1.2.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_3595:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_3785_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_3785:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5405_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5405:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5415_firmware:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5415:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5485_firmware:*:*:*:*:*:*:*:* Versions before 2.7.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5485:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5505_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5505:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5515_firmware:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5515:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5575_firmware:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5575:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5585_firmware:*:*:*:*:*:*:*:* Versions before 2.7.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5585:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5675_firmware:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5675:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5775_firmware:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5775:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_7375_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_7375:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_7405_firmware:*:*:*:*:*:*:*:* Versions before 1.7.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_7405:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_7415_firmware:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_7415:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_3405_firmware:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_3405:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_3515_firmware:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_3515:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_5415_firmware:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_5415:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_5515_firmware:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_5515:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA CPG BIOS (Dell) Fixed in 1.10.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell CPG BIOS 1.10.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-08294 Improper input validation in Dell CPG BIOSPriority LOW 32
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24417
  2. 2026-10-03 Alias added: GHSA-mcfm-qpjr-xxm3

References

Advisory 1

  • TI-2022-08294 Improper input validation in Dell CPG BIOS CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences