Read the docs
TI-2022-13262 Aliases CVE-2022-31223GHSA-2qf2-mq6q-w69h

Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability.

Priority LOW 11CWE-158Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by sending unexpected null bytes in order to read memory on the system.

Why it matters now

EPSS 0.00182 7th percentileScored 2026-11-07
Fix Fixed CPG BIOS (Dell): 21Q4 platforms

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellCPG BIOSbefore 21Q4 platforms21Q4 platformsPatch availableCNA
  • CPG BIOS VendorDell Affected before 21Q4 platforms Fixed in 21Q4 platforms Patch available CNA

CPE configurations NVD · 50

CPEVersionsRoleVendor
cpe:2.3:o:dell:chengming_3900_firmware:*:*:*:*:*:*:*:*before 1.1.66VulnerableDell
cpe:2.3:h:dell:chengming_3900:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_14_plus_7420_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableDell
cpe:2.3:h:dell:inspiron_14_plus_7420:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_16_plus_7620_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableDell
cpe:2.3:h:dell:inspiron_16_plus_7620:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_3910_firmware:*:*:*:*:*:*:*:*before 1.1.66VulnerableDell
cpe:2.3:h:dell:inspiron_3910:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5320_firmware:*:*:*:*:*:*:*:*before 1.1.0VulnerableDell
cpe:2.3:h:dell:inspiron_5320:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:chengming_3900_firmware:*:*:*:*:*:*:*:* Versions before 1.1.66 Vulnerable ·Dell
  • cpe:2.3:h:dell:chengming_3900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_14_plus_7420_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_14_plus_7420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_16_plus_7620_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_16_plus_7620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_3910_firmware:*:*:*:*:*:*:*:* Versions before 1.1.66 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_3910:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5320_firmware:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Show 40 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:dell:inspiron_5420_firmware:*:*:*:*:*:*:*:*before 1.4.1VulnerableDell
cpe:2.3:h:dell:inspiron_5420:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_5620_firmware:*:*:*:*:*:*:*:*before 1.4.1VulnerableDell
cpe:2.3:h:dell:inspiron_5620:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_7420_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableDell
cpe:2.3:h:dell:inspiron_7420:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:inspiron_7620_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableDell
cpe:2.3:h:dell:inspiron_7620:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_3000_firmware:*:*:*:*:*:*:*:*before 1.1.66VulnerableDell
cpe:2.3:h:dell:optiplex_3000:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_3000_thin_client_firmware:*:*:*:*:*:*:*:*before 1.0.7VulnerableDell
cpe:2.3:h:dell:optiplex_3000_thin_client:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_5000_firmware:*:*:*:*:*:*:*:*before 1.3.62VulnerableDell
cpe:2.3:h:dell:optiplex_5000:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_5400_firmware:*:*:*:*:*:*:*:*before 1.0.13VulnerableDell
cpe:2.3:h:dell:optiplex_5400:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_7000_firmware:*:*:*:*:*:*:*:*before 1.3.62VulnerableDell
cpe:2.3:h:dell:optiplex_7000:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_7000_oem_firmware:*:*:*:*:*:*:*:*before 1.3.62VulnerableDell
cpe:2.3:h:dell:optiplex_7000_oem:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:optiplex_7400_firmware:*:*:*:*:*:*:*:*before 1.0.13VulnerableDell
cpe:2.3:h:dell:optiplex_7400:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:precision_3460_small_form_factor_firmware:*:*:*:*:*:*:*:*before 1.3.62VulnerableDell
cpe:2.3:h:dell:precision_3460_small_form_factor:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:precision_3660_tower_firmware:*:*:*:*:*:*:*:*before 1.3.71VulnerableDell
cpe:2.3:h:dell:precision_3660_tower:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:precision_5770_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:precision_5770:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_3710_firmware:*:*:*:*:*:*:*:*before 1.1.66VulnerableDell
cpe:2.3:h:dell:vostro_3710:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_3910_firmware:*:*:*:*:*:*:*:*before 1.1.66VulnerableDell
cpe:2.3:h:dell:vostro_3910:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_5320_firmware:*:*:*:*:*:*:*:*before 1.1.0VulnerableDell
cpe:2.3:h:dell:vostro_5320:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_5620_firmware:*:*:*:*:*:*:*:*before 1.4.1VulnerableDell
cpe:2.3:h:dell:vostro_5620:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:vostro_7620_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableDell
cpe:2.3:h:dell:vostro_7620:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:o:dell:xps_17_9720_firmware:*:*:*:*:*:*:*:*before 1.6.0VulnerableDell
cpe:2.3:h:dell:xps_17_9720:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:inspiron_5420_firmware:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_5620_firmware:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_5620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_7420_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_7420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:inspiron_7620_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:inspiron_7620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_3000_firmware:*:*:*:*:*:*:*:* Versions before 1.1.66 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_3000_thin_client_firmware:*:*:*:*:*:*:*:* Versions before 1.0.7 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_3000_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_5000_firmware:*:*:*:*:*:*:*:* Versions before 1.3.62 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_5000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_5400_firmware:*:*:*:*:*:*:*:* Versions before 1.0.13 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_5400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_7000_firmware:*:*:*:*:*:*:*:* Versions before 1.3.62 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_7000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_7000_oem_firmware:*:*:*:*:*:*:*:* Versions before 1.3.62 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_7000_oem:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:optiplex_7400_firmware:*:*:*:*:*:*:*:* Versions before 1.0.13 Vulnerable ·Dell
  • cpe:2.3:h:dell:optiplex_7400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:precision_3460_small_form_factor_firmware:*:*:*:*:*:*:*:* Versions before 1.3.62 Vulnerable ·Dell
  • cpe:2.3:h:dell:precision_3460_small_form_factor:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:precision_3660_tower_firmware:*:*:*:*:*:*:*:* Versions before 1.3.71 Vulnerable ·Dell
  • cpe:2.3:h:dell:precision_3660_tower:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:precision_5770_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:precision_5770:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_3710_firmware:*:*:*:*:*:*:*:* Versions before 1.1.66 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_3710:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_3910_firmware:*:*:*:*:*:*:*:* Versions before 1.1.66 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_3910:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_5320_firmware:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_5320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_5620_firmware:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_5620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:vostro_7620_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:vostro_7620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:o:dell:xps_17_9720_firmware:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Dell
  • cpe:2.3:h:dell:xps_17_9720:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA CPG BIOS (Dell) Fixed in 21Q4 platforms

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell CPG BIOS 21Q4 platforms

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2022-13265 Stack-based buffer overflow in Dell CPG BIOSPriority LOW 33
    • TI-2022-13264 Dell BIOS versions contain an Unchecked Return Value vulnerability.Priority LOW 22
    • TI-2022-13259 Dell BIOS versions contain an Unchecked Return Value vulnerability.Priority LOW 22
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31223
  2. 2026-10-03 Alias added: GHSA-2qf2-mq6q-w69h

References

Patch 1

  • TI-2024-35208 Weak authentication in Dell Client Platform BIOS CVSS 3.1HIGH 8.2
  • TI-2023-23082 Link following in Dell Client Platform, Dell Dock Firmware CVSS 3.1HIGH 7.3
  • TI-2022-13265 Stack-based buffer overflow in Dell CPG BIOS CVSS 3.1HIGH 7.8
  • TI-2025-21364 Stack-based buffer overflow in Dell Client Platform BIOS CVSS 3.1MEDIUM 6.9
  • TI-2023-12655 Time-of-check time-of-use race condition in Dell CPG BIOS CVSS 3.1MEDIUM 6.9
  • TI-2024-00146 Improper input validation in Dell CPG BIOS CVSS 3.1MEDIUM 6.7
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences