Intel BIOS: Mehrere Schwachstellen ermöglichen Privilegieneskalation
WID-SEC-2023-0374 · first 15.02.2023 · updated 23.01.2026 · CVSS 8,2
What it is about
Das BIOS ist die Firmware bei IBM PC kompatiblen Computern. Ein lokaler Angreifer kann mehrere Schwachstellen im BIOS für verschiedene Intel Prozessoren ausnutzen, um seine Privilegien zu erhöhen.
Under what conditions?
Only with access to the device or an account on it. Often the second step after a phishing email.
What can happen in the worst case
An attacker could use the vulnerability to
- seine Privilegien zu erhöhen
Am I affected?
Affected according to the BSI:
- F5 BIG-IP
- Dell Computer
- HPE ProLiant
- Intel BIOS
- EMC Avamar
- Dell BIOS
- Dell PowerEdge
- HPE Synergy
- HP Computer
- Dell PowerEdge T40 <1.10.0
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Dell PowerEdge T40 1.10.0
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Intel Security Advisory INTEL-SA-00717 vom 2023-02-14 www.intel.com
- HP Security Bulletin HPSBHF03834 vom 2023-02-14 support.hp.com
- HPE Security Bulletin HPESBHF04414 rev.1 vom 2023-02-15 support.hpe.com
- HPE Security Bulletin HPESBHF04434 rev.1 vom 2023-02-15 support.hpe.com
- Dell Security Advisory DSA-2023-049 vom 2023-02-23 www.dell.com
- Dell Security Advisory DSA-2023-015 vom 2023-02-23 www.dell.com
- HPE Security Bulletin support.hpe.com
- HPE Security Bulletin support.hpe.com
- F5 Security Advisory K000133630 vom 2023-04-24 my.f5.com
- HPE Securi+y Bulletin support.hpe.com
- Dell Security Advisory DSA-2024-250 vom 2024-06-27 www.dell.com
- Dell Security Advisory DSA-2023-014 vom 2026-01-22 www.dell.com
CVE: CVE-2021-0187, CVE-2022-26343, CVE-2022-26837, CVE-2022-30539, CVE-2022-30704, CVE-2022-32231
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.