Details of VAR-202405-3505

ID

VAR-202405-3505

CVE

CVE-2024-22429

TITLE

Vulnerabilities in multiple Dell products

Trust: 0.8

sources: JVNDB: JVNDB-2024-017849

DESCRIPTION

Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to arbitrary code execution. Dell Edge Gateway 5000 firmware, precision 5820 tower firmware, Dell Edge Gateway 3000 Unspecified vulnerabilities exist in multiple Dell products, including firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2024-22429 // JVNDB: JVNDB-2024-017849

AFFECTED PRODUCTS

vendor:	dell	model:	embedded box pc 5000	scope:	lt	version:	1.25.0	Trust: 1.0
vendor:	dell	model:	precision 3620 tower	scope:	lt	version:	2.30.0	Trust: 1.0
vendor:	dell	model:	latitude 5290	scope:	lt	version:	1.35.0	Trust: 1.0
vendor:	dell	model:	latitude 5580	scope:	lt	version:	1.36.0	Trust: 1.0
vendor:	dell	model:	latitude 7424 rugged extreme	scope:	lt	version:	1.32.0	Trust: 1.0
vendor:	dell	model:	latitude 5288	scope:	lt	version:	1.36.0	Trust: 1.0
vendor:	dell	model:	latitude 7280	scope:	lt	version:	1.37.0	Trust: 1.0
vendor:	dell	model:	precision 5520	scope:	lt	version:	1.38.0	Trust: 1.0
vendor:	dell	model:	edge gateway 5000	scope:	lt	version:	1.28.0	Trust: 1.0
vendor:	dell	model:	latitude 3390 2-in-1	scope:	lt	version:	1.31.0	Trust: 1.0
vendor:	dell	model:	latitude 5400	scope:	lt	version:	1.30.0	Trust: 1.0
vendor:	dell	model:	latitude 7480	scope:	lt	version:	1.37.0	Trust: 1.0
vendor:	dell	model:	latitude 7380	scope:	lt	version:	1.37.0	Trust: 1.0
vendor:	dell	model:	latitude 7414 rugged	scope:	lt	version:	1.46.0	Trust: 1.0
vendor:	dell	model:	latitude 7290	scope:	lt	version:	1.38.0	Trust: 1.0
vendor:	dell	model:	latitude 7390	scope:	lt	version:	1.38.0	Trust: 1.0
vendor:	dell	model:	latitude 5490	scope:	lt	version:	1.35.0	Trust: 1.0
vendor:	dell	model:	latitude 5420 rugged	scope:	lt	version:	1.32.0	Trust: 1.0
vendor:	dell	model:	optiplex 7450 all-in-one	scope:	lt	version:	1.32.0	Trust: 1.0
vendor:	dell	model:	latitude 7285 2-in-1	scope:	lt	version:	1.26.0	Trust: 1.0
vendor:	dell	model:	latitude 5280	scope:	lt	version:	1.36.0	Trust: 1.0
vendor:	dell	model:	optiplex 3050 all-in-one	scope:	lt	version:	1.32.0	Trust: 1.0
vendor:	dell	model:	precision 3420 tower	scope:	lt	version:	2.30.0	Trust: 1.0
vendor:	dell	model:	latitude 5290 2-in-1	scope:	lt	version:	1.34.0	Trust: 1.0
vendor:	dell	model:	precision 3520	scope:	lt	version:	1.36.0	Trust: 1.0
vendor:	dell	model:	latitude 5488	scope:	lt	version:	1.36.0	Trust: 1.0
vendor:	dell	model:	latitude 7390 2-in-1	scope:	lt	version:	1.35.0	Trust: 1.0
vendor:	dell	model:	latitude 5424 rugged	scope:	lt	version:	1.32.0	Trust: 1.0
vendor:	dell	model:	latitude 5590	scope:	lt	version:	1.35.0	Trust: 1.0
vendor:	dell	model:	latitude 3190	scope:	lt	version:	1.34.0	Trust: 1.0
vendor:	dell	model:	latitude 3180	scope:	lt	version:	1.29.0	Trust: 1.0
vendor:	dell	model:	precision 7720	scope:	lt	version:	1.36.0	Trust: 1.0
vendor:	dell	model:	latitude 7212 rugged extreme tablet	scope:	lt	version:	1.50.0	Trust: 1.0
vendor:	dell	model:	precision 7520	scope:	lt	version:	1.36.0	Trust: 1.0
vendor:	dell	model:	latitude 3190 2-in-1	scope:	lt	version:	1.34.0	Trust: 1.0
vendor:	dell	model:	latitude 12 rugged extreme 7214	scope:	lt	version:	1.46.0	Trust: 1.0
vendor:	dell	model:	wyse 7040 thin client	scope:	lt	version:	1.25.0	Trust: 1.0
vendor:	dell	model:	latitude 5480	scope:	lt	version:	1.36.0	Trust: 1.0
vendor:	dell	model:	latitude 13 3380	scope:	lt	version:	1.27.0	Trust: 1.0
vendor:	dell	model:	latitude 3189	scope:	lt	version:	1.29.0	Trust: 1.0
vendor:	dell	model:	wyse 5070	scope:	lt	version:	1.31.0	Trust: 1.0
vendor:	dell	model:	optiplex 5050	scope:	lt	version:	1.30.0	Trust: 1.0
vendor:	dell	model:	latitude 7490	scope:	lt	version:	1.38.0	Trust: 1.0
vendor:	dell	model:	optiplex 3050	scope:	lt	version:	1.30.0	Trust: 1.0
vendor:	dell	model:	precision 5820 tower	scope:	lt	version:	2.36.0	Trust: 1.0
vendor:	dell	model:	precision 5530 2-in-1	scope:	lt	version:	1.31.8	Trust: 1.0
vendor:	dell	model:	latitude 3300	scope:	lt	version:	1.28.0	Trust: 1.0
vendor:	dell	model:	edge gateway 3000	scope:	lt	version:	1.18.0	Trust: 1.0
vendor:	dell	model:	latitude 5414 rugged	scope:	lt	version:	1.46.0	Trust: 1.0
vendor:	dell	model:	embedded box pc 3000	scope:	lt	version:	1.24.0	Trust: 1.0
vendor:	デル	model:	embedded box pc 5000	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 3189	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 5288	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 3390 2-in-1	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 5400	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 5420 rugged	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 13 3380	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 3190 2-in-1	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	dell edge gateway 5000	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 12 rugged extreme 7214	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 3180	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	precision 5820 tower	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	dell edge gateway 3000	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 5290 2-in-1	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 5414 rugged	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 5290	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 3190	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 5280	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	latitude 3300	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	embedded box pc 3000	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2024-017849 // NVD: CVE-2024-22429

CVSS

SEVERITY

CVSSV2

CVSSV3

security_alert@emc.com:	CVE-2024-22429
value:	HIGH
Trust: 1.0
nvd@nist.gov:	CVE-2024-22429
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2024-22429
value:	MEDIUM
Trust: 0.8

security_alert@emc.com:	CVE-2024-22429
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	HIGH
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	6.0
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2024-22429
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2024-22429
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2024-017849 // NVD: CVE-2024-22429 // NVD: CVE-2024-22429

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-20	Trust: 1.0
problemtype:	Inappropriate input confirmation (CWE-20) [ others ]	Trust: 0.8
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-017849 // NVD: CVE-2024-22429

EXTERNAL IDS

db:	NVD	id:	CVE-2024-22429	Trust: 2.6
db:	JVNDB	id:	JVNDB-2024-017849	Trust: 0.8

sources: JVNDB: JVNDB-2024-017849 // NVD: CVE-2024-22429

REFERENCES

url:	https://www.dell.com/support/kbdoc/en-us/000221102/dsa-2024-020	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2024-22429	Trust: 0.8

sources: JVNDB: JVNDB-2024-017849 // NVD: CVE-2024-22429

SOURCES

db:	JVNDB	id:	JVNDB-2024-017849
db:	NVD	id:	CVE-2024-22429

LAST UPDATE DATE

2025-02-04T23:33:52.924000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2024-017849	date:	2025-01-31T07:37:00
db:	NVD	id:	CVE-2024-22429	date:	2025-01-30T15:48:29.167

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2024-017849	date:	2025-01-31T00:00:00
db:	NVD	id:	CVE-2024-22429	date:	2024-05-17T16:15:07.477