CVE-2024-38296

Dell Edge Gateway 3200, versions prior to 15.40.30.2879, and Edge Gateway 5200, versions prior to 12.0.94.2380, contain an Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000250949/dsa-2024-345-security-update-for-dell-networking-edge-gateway-5200-vulnerability	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:dell:intel_management_engine_firmware_update_utility:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:edge_gateway_3200:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:a:dell:intel_management_engine_firmware_update_utility:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:edge_gateway_5200:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-11-22 03:15

Updated : 2025-02-04 16:05

NVD link : CVE-2024-38296

Mitre link : CVE-2024-38296

CVE.ORG link : CVE-2024-38296

JSON object : View

Products Affected

dell

edge_gateway_5200
intel_management_engine_firmware_update_utility
edge_gateway_3200

CWE

NVD-CWE-noinfo

{"id": "CVE-2024-38296", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2024-11-22T03:15:04.160", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000250949/dsa-2024-345-security-update-for-dell-networking-edge-gateway-5200-vulnerability", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Dell Edge Gateway 3200, versions prior to 15.40.30.2879, and Edge Gateway 5200, versions prior to 12.0.94.2380, contain an Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure."}, {"lang": "es", "value": "Dell Edge Gateway 5200 (Coffee Lake S), versiones anteriores a 12.0.94.2380, contiene una vulnerabilidad de exposici\u00f3n de informaci\u00f3n confidencial en estructuras microarquitect\u00f3nicas compartidas durante la ejecuci\u00f3n transitoria. Un atacante con privilegios elevados y acceso local podr\u00eda aprovechar esta vulnerabilidad, lo que provocar\u00eda la exposici\u00f3n de informaci\u00f3n."}], "lastModified": "2025-02-04T16:05:01.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:intel_management_engine_firmware_update_utility:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "995658F4-37C9-478C-B622-02315A6F935F", "versionEndExcluding": "15.40.30.2879"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:edge_gateway_3200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FBA59414-5A32-4706-85A5-D5459EE22BA5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:intel_management_engine_firmware_update_utility:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AEE84CB-69AA-45C3-9414-EB9CE7C21531", "versionEndExcluding": "12.0.94.2380"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:edge_gateway_5200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F6832A53-E950-4572-A178-CF5DC14CACC5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}