Skip to main content

Alienware M15 R7 Firmware CVE-2023-28075

MEDIUM
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2023-08-16 security_alert@emc.com
RCE Dell Alienware M15 R7 Firmware Latitude 5300 2 In 1 Firmware Latitude 5310 Firmware Latitude 5310 2 In 1 Firmware Latitude 5400 Firmware Latitude 5411 Firmware Latitude 5420 Firmware Latitude 5420 Rugged Firmware Latitude 5424 Rugged Firmware Latitude 5430 Firmware Latitude 5431 Firmware Latitude 5480 Firmware Latitude 5488 Firmware Latitude 5500 Firmware Latitude 5511 Firmware Latitude 5580 Firmware Latitude 7200 2 In 1 Firmware Chengming 3900 Firmware Chengming 3910 Firmware Chengming 3911 Firmware Chengming 3990 Firmware Chengming 3991 Firmware Embedded Box Pc 3000 Firmware Embedded Box Pc 5000 Firmware Inspiron 14 5410 Firmware Inspiron 14 5418 Firmware Latitude 7210 2 In 1 Firmware Latitude 7280 Firmware Latitude 7290 Firmware Latitude 7300 Firmware Latitude 7310 Firmware Latitude 7320 Firmware Latitude 7380 Firmware Latitude 7390 Firmware Latitude 7390 2 In 1 Firmware Latitude 7400 Firmware Latitude 7400 2 In 1 Firmware Latitude 7410 Firmware Latitude 7420 Firmware Latitude 7424 Rugged Extreme Firmware Latitude 7480 Firmware Latitude 7490 Firmware Latitude 7520 Firmware Latitude 9330 Firmware Latitude 9410 Firmware Latitude 9520 Firmware Precision 3650 Tower Firmware Precision 3660 Firmware Precision 3930 Rack Firmware Precision 5470 Firmware Precision 5530 Firmware Precision 5530 2 In 1 Firmware Precision 5540 Firmware Precision 5570 Firmware Precision 5680 Firmware Precision 5860 Tower Firmware Precision 7520 Firmware Precision 7540 Firmware Precision 7550 Firmware Precision 7720 Firmware Precision 7740 Firmware Precision 7750 Firmware Precision 7960 Tower Firmware Inspiron 15 3511 Firmware Inspiron 15 5510 Firmware Inspiron 15 5518 Firmware Inspiron 24 5420 All In One Firmware Inspiron 27 7720 All In One Firmware Inspiron 3020 Desktop Firmware Inspiron 3020 Small Desktop Firmware Inspiron 3880 Firmware Inspiron 3881 Firmware Inspiron 3891 Firmware Inspiron 3910 Firmware Inspiron 5400 Firmware Inspiron 5401 Aio Firmware Inspiron 5410 Firmware Latitude Rugged 7220Ex Firmware Optiplex 3000 Thin Client Firmware Optiplex 3050 All In One Firmware Optiplex 3090 Firmware Optiplex 3280 All In One Firmware Optiplex 5270 All In One Firmware Optiplex 5400 All In One Firmware Optiplex 5480 All In One Firmware Optiplex 5490 All In One Firmware Optiplex 7070 Firmware Optiplex 7070 Ultra Firmware Optiplex 7080 Firmware Optiplex 7400 All In One Firmware Optiplex 7470 All In One Firmware Optiplex 7480 All In One Firmware Optiplex 7490 All In One Firmware Vostro 3681 Firmware Vostro 3690 Firmware Vostro 3710 Firmware Vostro 3881 Firmware Vostro 3888 Firmware Vostro 3890 Firmware Vostro 3910 Firmware Latitude 3180 Firmware Latitude 3189 Firmware Latitude 3190 Firmware Latitude 3190 2 In 1 Firmware Latitude 3310 Firmware Latitude 3310 2 In 1 Firmware Latitude 3320 Firmware Latitude 3330 Firmware Latitude 3340 Firmware Latitude 3400 Firmware Latitude 3430 Firmware Latitude 3440 Firmware Latitude 3500 Firmware Latitude 3530 Firmware Latitude 3540 Firmware Latitude 5290 2 In 1 Firmware Latitude 5300 Firmware Optiplex 7770 All In One Firmware Optiplex 7780 All In One Firmware Optiplex Micro Plus 7010 Firmware Latitude 3140 Firmware Latitude 3120 Firmware Inspiron 7700 All In One Firmware Inspiron 7501 Firmware Inspiron 7500 Firmware Wyse 5470 Firmware Vostro 7500 Firmware Vostro 5890 Firmware Optiplex Small Form Factor Plus 7010 Firmware Optiplex Tower Plus 7010 Firmware Precision 3240 Compact Firmware Precision 3260 Xe Compact Firmware Precision 3260 Compact Firmware Precision 3450 Firmware Precision 3460 Xe Small Form Factor Firmware Precision 3460 Small Form Factor Firmware Precision 3470 Firmware Precision 3540 Firmware Precision 3551 Firmware Wyse 5470 All In One Firmware Xps 13 7390 Firmware Xps 13 7390 2 In 1 Firmware Xps 13 9300 Firmware Xps 13 9310 Firmware Xps 13 9310 2 In 1 Firmware Xps 13 9315 Firmware Xps 15 7590 Firmware Xps 15 9520 Firmware Edge Gateway 5000 Firmware G15 5520 Firmware G16 7620 Firmware Precision 3630 Tower Firmware Precision 5820 Tower Firmware Precision 7820 Tower Firmware Precision 7920 Tower Firmware Xps 13 9305 Firmware Chengming 3980 Firmware Inspiron 3470 Firmware Inspiron 3480 Firmware Inspiron 3481 Firmware Inspiron 3580 Firmware Inspiron 3583 Firmware Inspiron 3581 Firmware Inspiron 3584 Firmware Inspiron 3780 Firmware Inspiron 3781 Firmware Latitude 5280 Firmware Latitude 5288 Firmware Optiplex 7060 Firmware Precision 3520 Firmware Precision 5520 Firmware Precision 5720 Aio Firmware Vostro 3070 Firmware Vostro 3470 Firmware Vostro 3480 Firmware Vostro 3580 Firmware Vostro 3581 Firmware Vostro 3584 Firmware Vostro 3583 Firmware Vostro 3670 Firmware G5 15 5590 Firmware G7 15 7590 Firmware G7 17 7790 Firmware Inspiron 3493 Firmware Inspiron 3593 Firmware Inspiron 3793 Firmware Inspiron 5493 Firmware Inspiron 5593 Firmware Inspiron 7490 Firmware Inspiron 7590 Firmware Inspiron 7591 Firmware Latitude 3301 Firmware Vostro 3481 Firmware Vostro 7590 Firmware Xps 13 9380 Firmware Inspiron 3670 Firmware Optiplex 5250 Firmware Optiplex 7450 Firmware G5 15 5500 Firmware Inspiron 7300 2 In 1 Firmware Inspiron 5490 Aio Firmware Latitude 9510 Firmware Precision 3640 Tower Firmware G3 3500 Firmware Inspiron 7610 Firmware Latitude 5285 2 In 1 Firmware Xps 15 9575 2 In 1 Firmware Inspiron 7790 Firmware Latitude Rugged 7220 Firmware Edge Gateway 3000 Firmware Inspiron 7510 Firmware Vostro 5410 Firmware Vostro 5491 Firmware Vostro 5510 Firmware Vostro 5591 Firmware Vostro 7510 Firmware G7 17 7700 Firmware Inspiron 3511 Firmware Inspiron 5491 Aio Firmware Latitude Rugged 5430 Firmware Latitude Rugged 7330 Firmware Optiplex 5090 Firmware Optiplex 5260 All In One Firmware Optiplex 7090 Firmware Vostro 3510 Firmware Optiplex 3000 Firmware Optiplex 5000 Firmware Optiplex 7000 Firmware Optiplex 7460 All In One Firmware G7 15 7500 Firmware Inspiron 7500 2 In 1 Black Firmware Latitude 7285 2 In 1 Firmware Optiplex 7760 All In One Firmware Alienware M16 Firmware Chengming 3901 Firmware Inspiron 24 5421 All In One Firmware Latitude 7230 Rugged Extreme Tablet Firmware Optiplex 7410 All In One Firmware Vostro 3020 Sff Firmware Vostro 3020 T Firmware Alienware M18 Firmware Optiplex Xe4 Firmware
6.3
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-367
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
Impact

CVSS score of 6.3 (MEDIUM). Attack characteristics: physical attack vector, high complexity, low privileges required, no user interaction not required.
Exploit ScenarioDerived

Successful exploitation could compromise the medium-severity affected system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. Rated medium severity (CVSS 6.3). No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-367. Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. A local authenticated malicious user with physical access to the system could potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI in order to gain arbitrary code execution on the system. Affected products include: Dell Alienware M15 R7 Firmware, Dell Alienware M16 Firmware, Dell Alienware M18 Firmware, Dell Chengming 3900 Firmware, Dell Chengming 3901 Firmware.

Know when Alienware M15 R7 Firmware gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.3 MEDIUM
AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Physical
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionNVD

Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. A local authenticated malicious user with physical access to the system could potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI in order to gain arbitrary code execution on the system.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Data Quality
2 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available No
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)NVD

cpe:2.3:o:dell:alienware_m15_r7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:alienware_m16_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:alienware_m18_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:chengming_3900_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:chengming_3901_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:chengming_3910_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:chengming_3911_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:chengming_3980_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:chengming_3990_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:chengming_3991_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g15_5520_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g16_7620_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g3_3500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g5_15_5500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g5_15_5590_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_15_7500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_15_7590_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_17_7700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_17_7790_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:precision_5680_firmware:*:*:*:*:*:*:*:*
+ 225 more

More in Alienware M15 R7 Firmware

View all
CVE-2024-52541 HIGH
8.2 Feb 19

Dell Client Platform BIOS contains a Weak Authentication vulnerability. Rated high severity (CVSS 8.2), this vulnerabili
CVE-2025-29988 MEDIUM
6.9 Apr 09

Dell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability. Rated medium severity (CVSS 6.9), this v
CVE-2023-32480 MEDIUM
6.8 Jun 23

Dell BIOS contains an Improper Input Validation vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is n
CVE-2024-0158 MEDIUM
6.7 Jul 02

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28060 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28058 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28050 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28044 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28036 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28034 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28031 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28027 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2023-35311 HIGH
8.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://www.dell.com/support/kbdoc/en-us/000212817/dsa-2023-152-security-update-for-a-dell-client-bios-vulnerability

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy