EUVD-2026-88295
GHSA-4hjf-cp9c-q5mw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical access to server chassis
-
DeliveryConnect to SMCU on-chip debug/test interface
-
ExploitExploit improper access control on 17G BOSS-N1
-
ExecutionRead/modify boot storage controller state
-
ImpactFull compromise of controller confidentiality/integrity/availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture On-chip debug access control
|
| Exploitation Conditions | Exploitation requires direct PHYSICAL access to the on-chip debug and test interface of the SMCU on a Dell 17G BOSS-N1 controller running firmware prior to 2.2.13.2038 - the attacker must be at the hardware, typically with the chassis opened and a debug connection to the controller. Limiting factors are significant: physical presence (AV:P), high attack complexity requiring hardware/debug expertise (AC:H), and required user interaction (UI:R). This confines realistic exploitation to insider, supply-chain, in-transit, decommissioned/RMA, or unattended-data-center scenarios rather than remote or automated attacks. The affected scope is specifically 17G-generation BOSS-N1 controllers; other generations/models are not indicated as affected. |
| Impact | Despite a CVSS base score of 7.0 (HIGH), real-world exploitation risk is LOW. The vector CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H makes the score misleading in isolation: the driving factors are the S:C scope change and full C:H/I:H/A:H impact, but the access preconditions are severe - Physical access (AV:P), High attack complexity (AC:H), and required User interaction (UI:R). An attacker must be physically present at the server, open the chassis, and interface with the on-chip debug/test port of the SMCU on a 17G BOSS-N1 controller. No EPSS score, no CISA KEV listing, and no public exploit code (POC) accompany this CVE. SSVC framing: exploitation status is 'none', it is NOT automatable (physical access precludes mass exploitation), and technical impact is 'total' - yielding a low-to-track disposition for most defenders. This is a genuine hardware access-control defect but is a targeted/insider or supply-chain/decommission concern rather than a mass-exploitation priority. Conflicting signal to note: the 'Authentication Bypass' tag and the CWE-1191 hardware-debug-interface reality do not fully align - this is a physical debug-port access-control weakness, not a network authentication bypass. |
| Exploit ScenarioDerived | An attacker with physical possession of a Dell PowerEdge server (e.g., during transit, in a colocation/data-center with lax physical controls, or on a decommissioned/RMA'd unit) opens the chassis, connects to the SMCU on-chip debug and test interface of the 17G BOSS-N1 boot storage controller, and leverages the improper access control to read/modify controller state and the boot storage it protects. No public exploit code exists at time of analysis, and the AC:H/UI:R vector means specialized hardware knowledge and hands-on interaction are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
An unauthenticated attacker (CVSS PR:N) who obtains physical access to the on-chip debug and test interface of the SMCU on Dell 17G BOSS-N1 controllers can bypass the intended access controls and gain unauthorized access to the controller before firmware version 2.2.13.2038 is applied. Exploitation is constrained by the need for direct hardware contact - typically an opened chassis and a debug connection - plus high attack complexity and a required interaction step (AV:P/AC:H/UI:R), so the practical risk is LOW despite the HIGH 7.0 base score with scope change and full confidentiality, integrity, and availability impact on the component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); realistic exposure is limited to insider, supply-chain, in-transit, decommissioned/RMA, or unattended data-center scenarios.
RemediationAI
Apply the Dell firmware update that resolves the issue, upgrading Dell BOSS-N1 controller firmware to version 2.2.13.2038 or later as described in Dell advisory DSA-2026-402 (https://www.dell.com/support/kbdoc/en-us/000513073/dsa-2026-402-security-update-for-dell-boot-optimized-server-storage-boss-vulnerability); because the flaw lives in the SMCU debug interface, the firmware package must be applied to the controller itself, not only to the host BIOS or iDRAC, and a reboot or controller reset may be required. Until the update is staged, the effective controls are physical and procedural rather than network-based: restrict and log physical access to server chassis and racks (badge access, locked cabinets, tamper-evident seals), keep cabinets closed and monitored so the on-chip debug interface cannot be probed, and maintain strict chain-of-custody for hardware in transit, RMA returns, and decommissioned units so that controllers do not pass through untrusted hands - the trade-off is increased operational overhead and slower service workflows, and seals must be inspected after any maintenance. Blocking management networks or disabling iDRAC alone is not a valid mitigation here since the attack path is physical, and no vendor workaround beyond physical controls is described in the available data; note that no public exploit code or active exploitation is known at this time, so prioritization should be driven by physical-exposure risk rather than urgency from observed attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness is CWE-1191, On-Chip Debug and Test Interface With Improper Access Control, applied to the System Management Control Unit (SMCU) of Dell's Boot Optimized Server Storage (BOSS) module. BOSS is a hardware RAID/boot device that provides a redundant boot volume for PowerEdge servers, and its SMCU governs low-level controller state; when the chip's debug/test interface is left reachable without adequate authentication or lockdown, an actor with physical probe access (for example a JTAG-style connection to the controller board) can interact directly with the silicon outside the normal firmware/management trust path. The CVSS:3.1 vector AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H indicates the flaw is only reachable with physical access, requires a high degree of expertise and specific conditions to exploit, needs no prior authentication, and involves a user-interaction element, while a successful attack crosses a security boundary (S:C) and compromises confidentiality, integrity, and availability of the affected component. The impacted scope is specifically 17G-generation BOSS-N1 controllers; other generations and models are not indicated as affected.
Know when Boot Optimized Server Storage Boss gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Physical debug-port access (AV:P) needing hardware expertise and hands-on interaction (AC:H, UI:R); improper debug access control grants full control of the boot-storage controller and impacts the host it serves (S:C, C/I/A:H).
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Unauthorized access.
Executive ViewAI
Dell 17G BOSS-N1 controllers are affected by a high-severity access-control bypass in the SMCU debug interface that requires physical access and high complexity, making realistic organizational exposure low and limited to insider, supply-chain, or decommissioned-hardware scenarios. Although exploitation could fully compromise the controller’s confidentiality, integrity, and availability, there is no public exploit identified at time of analysis, and an unauthenticated attacker would still need direct hardware contact. Leadership should ensure physical security and asset lifecycle controls are maintained and prioritize applying firmware version 2.2.13.2038 to affected controllers.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Dell BOSS-N1 controllers running firmware prior to 2.2.13.2038 expose an unprotected on-chip debug and test interface on
Unauthenticated physical attackers with access to a server's internals can exploit an improperly protected on-chip debug
Exploit-DB