Privilege escalation in Dell Latitude E6430
CVE-2015-0949
The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implementations does not ensure that function calls operate on SMRAM memory locations, which allows local users to bypass the Secure Boot protection mechanism and gain privileges by leveraging write access to physical memory.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (31.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 31.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Dell Latitude E6430 — versions BIOS Revision A09
- Dell Latitude E6430
- Dell Latitude E6430 Firmware — versions a09
- HP Elitebook 850 G1 — versions BIOS revision L71 Ver. 01.09
- HP Elitebook 850 G1
- HP Elitebook 850 G1 Firmware — versions 01.09
Weakness classification (CWE)
References
- www.kb.cert.org/vuls/id/631788 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2015-0949?
- CVE-2015-0949 is a high-severity vulnerability in Dell Latitude E6430, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2020-01-30.
- How severe is CVE-2015-0949?
- High severity. CVSS v3 base score is 7.8 out of 10.