Boot Optimized Server Storage Boss
Monthly
An unauthenticated attacker (CVSS PR:N) who obtains physical access to the on-chip debug and test interface of the SMCU on Dell 17G BOSS-N1 controllers can bypass the intended access controls and gain unauthorized access to the controller before firmware version 2.2.13.2038 is applied. Exploitation is constrained by the need for direct hardware contact - typically an opened chassis and a debug connection - plus high attack complexity and a required interaction step (AV:P/AC:H/UI:R), so the practical risk is LOW despite the HIGH 7.0 base score with scope change and full confidentiality, integrity, and availability impact on the component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); realistic exposure is limited to insider, supply-chain, in-transit, decommissioned/RMA, or unattended data-center scenarios.
Dell BOSS-N1 controllers running firmware prior to 2.2.13.2038 expose an unprotected on-chip debug and test interface on the SMCU, allowing anyone with physical access to bypass authentication and read or write protected controller memory, yielding high confidentiality, integrity, and availability impact (CVSS 6.8, AV:P/AC:L/PR:N/UI:N). The attack surface is strictly local: exploitation requires hands-on connection to the debug interface of the SMCU on a 17th-generation PowerEdge server, so remote or network attack is impossible and realistic exposure is limited to insiders, hardware in transit or during servicing, decommissioned or resold units, and evil-maid/supply-chain scenarios. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the physical-access prerequisite keeps practical priority low despite the Medium base score.
Unauthenticated physical attackers with access to a server's internals can exploit an improperly protected on-chip debug and test interface on the SMCU of Dell BOSS-N1 17G controllers (firmware prior to 2.2.13.2038) to gain unauthorized access, primarily threatening integrity. This is a low-priority, high-friction vulnerability requiring physical presence, high attack complexity, and user interaction, and no public exploit has been identified. Dell has released firmware version 2.2.13.2038 to address the issue.
An unauthenticated attacker (CVSS PR:N) who obtains physical access to the on-chip debug and test interface of the SMCU on Dell 17G BOSS-N1 controllers can bypass the intended access controls and gain unauthorized access to the controller before firmware version 2.2.13.2038 is applied. Exploitation is constrained by the need for direct hardware contact - typically an opened chassis and a debug connection - plus high attack complexity and a required interaction step (AV:P/AC:H/UI:R), so the practical risk is LOW despite the HIGH 7.0 base score with scope change and full confidentiality, integrity, and availability impact on the component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); realistic exposure is limited to insider, supply-chain, in-transit, decommissioned/RMA, or unattended data-center scenarios.
Dell BOSS-N1 controllers running firmware prior to 2.2.13.2038 expose an unprotected on-chip debug and test interface on the SMCU, allowing anyone with physical access to bypass authentication and read or write protected controller memory, yielding high confidentiality, integrity, and availability impact (CVSS 6.8, AV:P/AC:L/PR:N/UI:N). The attack surface is strictly local: exploitation requires hands-on connection to the debug interface of the SMCU on a 17th-generation PowerEdge server, so remote or network attack is impossible and realistic exposure is limited to insiders, hardware in transit or during servicing, decommissioned or resold units, and evil-maid/supply-chain scenarios. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the physical-access prerequisite keeps practical priority low despite the Medium base score.
Unauthenticated physical attackers with access to a server's internals can exploit an improperly protected on-chip debug and test interface on the SMCU of Dell BOSS-N1 17G controllers (firmware prior to 2.2.13.2038) to gain unauthorized access, primarily threatening integrity. This is a low-priority, high-friction vulnerability requiring physical presence, high attack complexity, and user interaction, and no public exploit has been identified. Dell has released firmware version 2.2.13.2038 to address the issue.