Dell client security update for Intel RST

Published: 2022-08-11

Risk	High
Patch available	YES
Number of vulnerabilities	1
CVE-ID	CVE-2018-1285
CWE-ID	CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	XPS 15 9575 2-in-1 Hardware solutions / Firmware XPS 13 9370 Hardware solutions / Firmware Wyse 7040 Thin Client Hardware solutions / Firmware Vostro 3669 Hardware solutions / Firmware Vostro 3668 Hardware solutions / Firmware Vostro 3667 Hardware solutions / Firmware Vostro 3660 Hardware solutions / Firmware Vostro 3268 Hardware solutions / Firmware Vostro 3267 Hardware solutions / Firmware Precision 5530 2-in-1 Hardware solutions / Firmware Precision 5510 Hardware solutions / Firmware Precision 3620 Tower Hardware solutions / Firmware Precision 3510 Hardware solutions / Firmware Precision 3420 Tower Hardware solutions / Firmware OptiPlex 7440 All-In-One Hardware solutions / Firmware OptiPlex 7040 Hardware solutions / Firmware OptiPlex 5040 Hardware solutions / Firmware OptiPlex 3240 All-in-One Hardware solutions / Firmware OptiPlex 3046 Hardware solutions / Firmware OptiPlex 3040 Hardware solutions / Firmware Latitude E7470 Hardware solutions / Firmware Latitude E7270 Hardware solutions / Firmware Latitude E5570 Hardware solutions / Firmware Latitude E5470 Hardware solutions / Firmware Latitude E5270 Hardware solutions / Firmware Latitude 7480 Hardware solutions / Firmware Latitude 7414 Hardware solutions / Firmware Latitude 7380 Hardware solutions / Firmware Latitude 7370 Hardware solutions / Firmware Latitude 7280 Hardware solutions / Firmware Latitude 7275 2-in-1 Hardware solutions / Firmware Latitude 7214 Rugged Extreme Hardware solutions / Firmware Latitude 7212 Rugged Extreme Tablet Hardware solutions / Firmware Latitude 5580 Hardware solutions / Firmware Latitude 5488 Hardware solutions / Firmware Latitude 5480 Hardware solutions / Firmware Latitude 5288 Hardware solutions / Firmware Latitude 5280 Hardware solutions / Firmware Latitude 3390 Hardware solutions / Firmware Latitude 3379 Hardware solutions / Firmware Latitude 14 Rugged 5414 Hardware solutions / Firmware Latitude 13 3380 Hardware solutions / Firmware Inspiron 15 3567 Hardware solutions / Firmware Latitude 3580 Hardware solutions / Firmware Latitude 3480 Hardware solutions / Firmware Embedded Box PC 5000 Hardware solutions / Other hardware appliances
Vendor	Dell

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Improper input validation

EUVDB-ID: #VU49772

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1285

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Simphony Server (Apache log4net) component in Oracle Hospitality Simphony. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Mitigation

Install update from vendor's website.

Vulnerable software versions

XPS 15 9575 2-in-1: before 16.8.4.1011

XPS 13 9370: before 16.8.4.1011

Wyse 7040 Thin Client: before 16.8.4.1011

Vostro 3669: before 16.8.4.1011

Vostro 3668: before 16.8.4.1011

Vostro 3667: before 16.8.4.1011

Vostro 3660: before 16.8.4.1011

Vostro 3268: before 16.8.4.1011

Vostro 3267: before 16.8.4.1011

Precision 5530 2-in-1: before 16.8.4.1011

Precision 5510: before 16.8.4.1011

Precision 3620 Tower: before 16.8.4.1011

Precision 3510: before 16.8.4.1011

Precision 3420 Tower: before 16.8.4.1011

OptiPlex 7440 All-In-One: before 16.8.4.1011

OptiPlex 7040: before 16.8.4.1011

OptiPlex 5040: before 16.8.4.1011

OptiPlex 3240 All-in-One: before 16.8.4.1011

OptiPlex 3046: before 16.8.4.1011

OptiPlex 3040: before 16.8.4.1011

Latitude E7470: before 16.8.4.1011

Latitude E7270: before 16.8.4.1011

Latitude E5570: before 16.8.4.1011

Latitude E5470: before 16.8.4.1011

Latitude E5270: before 16.8.4.1011

Latitude 7480: before 16.8.4.1011

Latitude 7414: before 16.8.4.1011

Latitude 7380: before 16.8.4.1011

Latitude 7370: before 16.8.4.1011

Latitude 7280: before 16.8.4.1011

Latitude 7275 2-in-1: before 16.8.4.1011

Latitude 7214 Rugged Extreme: before 16.8.4.1011

Latitude 7212 Rugged Extreme Tablet: before 16.8.4.1011

Latitude 5580: before 16.8.4.1011

Latitude 5488: before 16.8.4.1011

Latitude 5480: before 16.8.4.1011

Latitude 5288: before 16.8.4.1011

Latitude 5280: before 16.8.4.1011

Latitude 3390: before 16.8.4.1011

Latitude 3379: before 16.8.4.1011

Latitude 14 Rugged 5414: before 16.8.4.1011

Latitude 13 3380: before 16.8.4.1011

Inspiron 15 3567: before 16.8.4.1011

Embedded Box PC 5000: before 16.8.4.1011

Latitude 3580: before 16.8.4.1011

Latitude 3480: before 16.8.4.1011

External links

http://www.dell.com/support/kbdoc/nl-nl/000202320/dsa-2022-233-dell-client-security-update-for-intel-rst-august-2022-software-advisory

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.