What is the CVSS score of CVE-2023-44298?

CVE-2023-44298 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Poweredge R660 Firmware CVE-2023-44298

MEDIUM

Hardware Internal or Debug Modes Allow Override of Locks (CWE-1234)

2023-12-05 security_alert@emc.com

RCE Denial Of Service Intel Dell Poweredge R660 Firmware Poweredge R760 Firmware Poweredge C6620 Firmware Poweredge Mx760C Firmware Poweredge R860 Firmware Poweredge R960 Firmware Poweredge Hs5610 Firmware Poweredge Hs5620 Firmware Poweredge R660Xs Firmware Poweredge R760Xs Firmware Poweredge R760Xd2 Firmware Poweredge T560 Firmware Poweredge R760Xa Firmware

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Dec 05, 2023 - 16:15 nvd

MEDIUM 6.8

DescriptionNVD

Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information tampering, code execution, denial of service.

AnalysisAI

Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1234. Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information tampering, code execution, denial of service. Affected products include: Dell Poweredge R660 Firmware, Dell Poweredge R760 Firmware, Dell Poweredge C6620 Firmware, Dell Poweredge Mx760C Firmware, Dell Poweredge R860 Firmware. Version information: version 1.4.4.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.