Skip to main content

Alienware M15 R7 Firmware CVE-2023-32453

LOW
Improper Authentication (CWE-287)
2023-08-16 security_alert@emc.com
Authentication Bypass Dell Alienware M15 R7 Firmware Latitude 5420 Firmware Latitude 5430 Firmware Latitude 5431 Firmware Chengming 3900 Firmware Chengming 3910 Firmware Chengming 3911 Firmware Inspiron 14 5410 Firmware Inspiron 14 5418 Firmware Latitude 7320 Firmware Latitude 7420 Firmware Latitude 7520 Firmware Latitude 9330 Firmware Latitude 9520 Firmware Precision 3650 Tower Firmware Precision 3660 Firmware Precision 5470 Firmware Precision 5570 Firmware Precision 5680 Firmware Precision 5860 Tower Firmware Precision 7960 Tower Firmware Inspiron 15 3511 Firmware Inspiron 15 5510 Firmware Inspiron 15 5518 Firmware Inspiron 24 5420 All In One Firmware Inspiron 27 7720 All In One Firmware Inspiron 3020 Desktop Firmware Inspiron 3020 Small Desktop Firmware Inspiron 3891 Firmware Inspiron 3910 Firmware Inspiron 5410 Firmware Optiplex 3000 Thin Client Firmware Optiplex 5400 All In One Firmware Optiplex 5490 All In One Firmware Optiplex 7400 All In One Firmware Optiplex 7490 All In One Firmware Vostro 3690 Firmware Vostro 3710 Firmware Vostro 3890 Firmware Vostro 3910 Firmware Latitude 3320 Firmware Latitude 3330 Firmware Latitude 3340 Firmware Latitude 3400 Firmware Latitude 3430 Firmware Latitude 3440 Firmware Latitude 3500 Firmware Latitude 3530 Firmware Latitude 3540 Firmware Optiplex Micro Plus 7010 Firmware Latitude 3140 Firmware Inspiron 7501 Firmware Inspiron 7500 Firmware Vostro 7500 Firmware Vostro 5890 Firmware Optiplex Small Form Factor Plus 7010 Firmware Optiplex Tower Plus 7010 Firmware Precision 3260 Xe Compact Firmware Precision 3260 Compact Firmware Precision 3450 Firmware Precision 3460 Xe Small Form Factor Firmware Precision 3460 Small Form Factor Firmware Precision 3470 Firmware Xps 13 7390 Firmware Xps 13 7390 2 In 1 Firmware Xps 13 9300 Firmware Xps 13 9310 Firmware Xps 13 9310 2 In 1 Firmware Xps 13 9315 Firmware Xps 15 9520 Firmware G15 5520 Firmware G16 7620 Firmware Xps 13 9305 Firmware Inspiron 3493 Firmware Inspiron 3593 Firmware Inspiron 3793 Firmware Inspiron 5493 Firmware Inspiron 5593 Firmware Inspiron 7490 Firmware Latitude 3301 Firmware G5 15 5500 Firmware Inspiron 7300 2 In 1 Firmware G3 3500 Firmware Inspiron 7610 Firmware Inspiron 7510 Firmware Vostro 5410 Firmware Vostro 5491 Firmware Vostro 5510 Firmware Vostro 5591 Firmware Vostro 7510 Firmware G7 17 7700 Firmware Inspiron 3511 Firmware Latitude Rugged 5430 Firmware Latitude Rugged 7330 Firmware Optiplex 5090 Firmware Optiplex 7090 Firmware Vostro 3510 Firmware Optiplex 3000 Firmware Optiplex 5000 Firmware Optiplex 7000 Firmware G7 15 7500 Firmware Inspiron 7500 2 In 1 Black Firmware Alienware M16 Firmware Chengming 3901 Firmware Inspiron 24 5421 All In One Firmware Latitude 7230 Rugged Extreme Tablet Firmware Optiplex 7410 All In One Firmware Vostro 3020 Sff Firmware Vostro 3020 T Firmware Alienware M18 Firmware Optiplex Xe4 Firmware
3.9
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-287
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK

2 techniques across 2 tactics: Defense Evasion, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS score of 3.9 (LOW). Attack characteristics: physical attack vector, low complexity, high privileges required, no user interaction not required.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to bypass authentication mechanisms to gain unauthorized access.
Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).
No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Dell BIOS contains an improper authentication vulnerability. Rated low severity (CVSS 3.9), this vulnerability is low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Dell BIOS contains an improper authentication vulnerability. A malicious user with physical access to the system may potentially exploit this vulnerability in order to modify a security-critical UEFI variable without knowledge of the BIOS administrator. Affected products include: Dell Alienware M15 R7 Firmware, Dell Alienware M16 Firmware, Dell Alienware M18 Firmware, Dell Chengming 3900 Firmware, Dell Chengming 3901 Firmware.

Know when Alienware M15 R7 Firmware gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 3.9 LOW
AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Physical
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

DescriptionNVD

Dell BIOS contains an improper authentication vulnerability. A malicious user with physical access to the system may potentially exploit this vulnerability in order to modify a security-critical UEFI variable without knowledge of the BIOS administrator.

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Data Quality
2 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity LOW
CISA KEV No
Public POC No
EPSS 0.2%
Patch available No
Active threat No
Deciding rule
LOW severity (CVSS 0.1-3.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Low

Priority Score

20
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +20
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)NVD

cpe:2.3:o:dell:alienware_m15_r7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:alienware_m16_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:alienware_m18_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:chengming_3900_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:chengming_3901_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:chengming_3910_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:chengming_3911_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g15_5520_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g16_7620_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g3_3500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g5_15_5500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_15_7500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:g7_17_7700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:precision_5680_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_14_5410_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_14_5418_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_15_3511_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_15_5510_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_15_5518_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:inspiron_24_5420_all-in-one_firmware:*:*:*:*:*:*:*:*
+ 91 more

More in Alienware M15 R7 Firmware

View all
CVE-2024-52541 HIGH
8.2 Feb 19

Dell Client Platform BIOS contains a Weak Authentication vulnerability. Rated high severity (CVSS 8.2), this vulnerabili
CVE-2025-29988 MEDIUM
6.9 Apr 09

Dell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability. Rated medium severity (CVSS 6.9), this v
CVE-2023-32480 MEDIUM
6.8 Jun 23

Dell BIOS contains an Improper Input Validation vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is n
CVE-2024-0158 MEDIUM
6.7 Jul 02

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28060 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28058 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28050 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28044 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28036 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28034 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28031 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l
CVE-2023-28027 MEDIUM
6.7 Jun 23

Dell BIOS contains an improper input validation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is l

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

References

Advisories & patches
ADVISORY https://www.dell.com/support/kbdoc/en-us/000215217/dsa-2023-190-dell-client-bios

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy