Dell client security update for Intel RST
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-1285 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
XPS 13 (9370) Hardware solutions / Firmware XPS 15 9575 2-in-1 Hardware solutions / Firmware Wyse 7040 Thin Client Hardware solutions / Firmware Vostro 3669 Hardware solutions / Firmware Vostro 3668 Hardware solutions / Firmware Vostro 3667 Hardware solutions / Firmware Vostro 3660 Hardware solutions / Firmware Vostro 3268 Hardware solutions / Firmware Vostro 3267 Hardware solutions / Firmware Precision 5530 2-in-1 Hardware solutions / Firmware Precision 5510 Hardware solutions / Firmware Precision 3620 Tower Hardware solutions / Firmware Precision 3510 Hardware solutions / Firmware Precision 3420 Tower Hardware solutions / Firmware OptiPlex 7440 All-In-One Hardware solutions / Firmware OptiPlex 7040 Hardware solutions / Firmware OptiPlex 5040 Hardware solutions / Firmware OptiPlex 3240 All-in-One Hardware solutions / Firmware OptiPlex 3046 Hardware solutions / Firmware OptiPlex 3040 Hardware solutions / Firmware Latitude E7470 Hardware solutions / Firmware Latitude E7270 Hardware solutions / Firmware Latitude E5570 Hardware solutions / Firmware Latitude E5470 Hardware solutions / Firmware Latitude E5270 Hardware solutions / Firmware Latitude 7480 Hardware solutions / Firmware Latitude 7414 Hardware solutions / Firmware Latitude 7380 Hardware solutions / Firmware Latitude 7370 Hardware solutions / Firmware Latitude 7280 Hardware solutions / Firmware Latitude 7275 2-in-1 Hardware solutions / Firmware Latitude 7214 Rugged Extreme Hardware solutions / Firmware Latitude 7212 Rugged Extreme Tablet Hardware solutions / Firmware Latitude 5580 Hardware solutions / Firmware Latitude 5488 Hardware solutions / Firmware Latitude 5480 Hardware solutions / Firmware Latitude 5288 Hardware solutions / Firmware Latitude 5280 Hardware solutions / Firmware Latitude 3390 Hardware solutions / Firmware Latitude 3379 Hardware solutions / Firmware Latitude 14 Rugged 5414 Hardware solutions / Firmware Latitude 13 3380 Hardware solutions / Firmware Inspiron 15 3567 Hardware solutions / Firmware Latitude 3580 Hardware solutions / Firmware Latitude 3480 Hardware solutions / Firmware Embedded Box PC 5000 Hardware solutions / Other hardware appliances |
| Vendor | Dell |
Security Bulletin
This security bulletin contains one high risk vulnerability.
1) Improper input validation
EUVDB-ID: #VU49772
Risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2018-1285
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Simphony Server (Apache log4net) component in Oracle Hospitality Simphony. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
MitigationInstall update from vendor's website.
Vulnerable software versionsXPS 13 (9370): before 16.8.4.1011
XPS 15 9575 2-in-1: before 16.8.4.1011
Wyse 7040 Thin Client: before 16.8.4.1011
Vostro 3669: before 16.8.4.1011
Vostro 3668: before 16.8.4.1011
Vostro 3667: before 16.8.4.1011
Vostro 3660: before 16.8.4.1011
Vostro 3268: before 16.8.4.1011
Vostro 3267: before 16.8.4.1011
Precision 5530 2-in-1: before 16.8.4.1011
Precision 5510: before 16.8.4.1011
Precision 3620 Tower: before 16.8.4.1011
Precision 3510: before 16.8.4.1011
Precision 3420 Tower: before 16.8.4.1011
OptiPlex 7440 All-In-One: before 16.8.4.1011
OptiPlex 7040: before 16.8.4.1011
OptiPlex 5040: before 16.8.4.1011
OptiPlex 3240 All-in-One: before 16.8.4.1011
OptiPlex 3046: before 16.8.4.1011
OptiPlex 3040: before 16.8.4.1011
Latitude E7470: before 16.8.4.1011
Latitude E7270: before 16.8.4.1011
Latitude E5570: before 16.8.4.1011
Latitude E5470: before 16.8.4.1011
Latitude E5270: before 16.8.4.1011
Latitude 7480: before 16.8.4.1011
Latitude 7414: before 16.8.4.1011
Latitude 7380: before 16.8.4.1011
Latitude 7370: before 16.8.4.1011
Latitude 7280: before 16.8.4.1011
Latitude 7275 2-in-1: before 16.8.4.1011
Latitude 7214 Rugged Extreme: before 16.8.4.1011
Latitude 7212 Rugged Extreme Tablet: before 16.8.4.1011
Latitude 5580: before 16.8.4.1011
Latitude 5488: before 16.8.4.1011
Latitude 5480: before 16.8.4.1011
Latitude 5288: before 16.8.4.1011
Latitude 5280: before 16.8.4.1011
Latitude 3390: before 16.8.4.1011
Latitude 3379: before 16.8.4.1011
Latitude 14 Rugged 5414: before 16.8.4.1011
Latitude 13 3380: before 16.8.4.1011
Inspiron 15 3567: before 16.8.4.1011
Embedded Box PC 5000: before 16.8.4.1011
Latitude 3580: before 16.8.4.1011
Latitude 3480: before 16.8.4.1011
CPE2.3- cpe:2.3:h:dell:xps_13_9370:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:xps_15_9575_2-in-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:wyse_7040_thin_client:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:vostro_3669:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:vostro_3668:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:vostro_3667:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:vostro_3660:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:vostro_3268:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:vostro_3267:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:precision_5530_2-in-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:precision_5510:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:precision_3620_tower:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:precision_3510:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:precision_3420_tower:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:optiplex_7440_all-in-one:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:optiplex_7040:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:optiplex_5040:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:optiplex_3240_all-in-one:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:optiplex_3046:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:optiplex_3040:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_e7470:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_e7270:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_e5570:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_e5470:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_e5270:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_7480:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_7414:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_7380:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_7370:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_7280:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_7275_2-in-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_7214_rugged_extreme:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_7212_rugged_extreme_tablet:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_5580:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_5488:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_5480:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_5288:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_5280:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_3390:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_3379:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_14_rugged_5414:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_13_3380:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:inspiron_15_3567:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:embedded_box_pc_5000:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_3580:*:*:*:*:*:*:*:*
- cpe:2.3:h:dell:latitude_3480:*:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
