CVE-2022-22567

moderate-risk

Published 2022-02-09

Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticity vulnerability. An authenticated malicious user may exploit this vulnerability in order to install modified BIOS firmware.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.7/10 Medium

LOCAL / HIGH complexity

Affected Products (20)

Alienware Area 51M R1 Firmware

Alienware Area 51M R2 Firmware

Alienware M15 R3 Firmware

Alienware M15 R4 Firmware

Alienware M15 R6 Firmware

Alienware M17 R3 Firmware

Alienware M17 R4 Firmware

Chengming 3990 Firmware

Chengming 3991 Firmware

G15 5510 Firmware

G15 5511 Firmware

G3 3500 Firmware

G3 3590 Firmware

G5 5000 Firmware

G5 5500 Firmware

G7 7500 Firmware

G7 7700 Firmware

Inspiron 14 5410 Firmware

Inspiron 14 5418 Firmware

Inspiron 15 5510 Firmware

Affected Vendors

Dell

References (2)

Vendor Advisory https://www.dell.com/support/kbdoc/en-us/000195905/dsa-2022-028

/ 100

moderate-risk

Severity 12/34 · Low

Exploitability 0/34 · Minimal

Exposure 33/34 · Critical