{"id":"CVE-2019-3717","published":"2019-08-05T16:38:20Z","modified":"2024-09-16T16:43:43Z","title":"Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability","vendor":"Dell","product":"Dell Client Commercial and Consumer platforms","tier":"core","eol":null,"affectedVersions":[{"vendor":"Dell","product":"Dell Client Commercial and Consumer platforms","versions":["https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019-043-dell-client-improper-access-control-vulnerability?lang=en"]}],"description":{"text":"Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical access to the system could potentially bypass intended Secure Boot restrictions to run unsigned and untrusted code on expansion cards installed in the system during platform boot. Refer to https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019-043-dell-client-improper-access-control-vulnerability?lang=en for versions affected by this vulnerability.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.1,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00362,"percentile":0.29972,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019-043-dell-client-improper-access-control-vulnerability?lang=en","tags":["x_refsource_CONFIRM"]}],"techniques":[{"id":"T1200","name":"Hardware Additions","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"exploitation_technique","evidence":[],"confidence":"high"},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-13352","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13352","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1200"],"provenance":"source"},{"stage":"primary","techniques":["T1548"],"provenance":"source"}],"timeline":[{"date":"2019-08-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-3717","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":11.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":5.99,"detail":"percentile 0.2997"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.97,"detail":"base score 7.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}