CVE-2024-0162 is a medium severity (CVSS 5.3) improper SMM communication buffer verification flaw in Dell PowerEdge Server BIOS and Dell Precision Rack BIOS. A local, low privileged attacker could cause out of bounds reads and writes to SMRAM. Fixed BIOS versions are listed per model in DSA-2024-004.
What's affected
Dell advisory DSA-2024-004 says affected BIOS versions are those before the fixed version for each model. Examples from its table:
- 2.0.0: PowerEdge R660, R760, C6620, MX760c and related models
- 1.13.2: PowerEdge R650, R750, R550, R450 and related models
- 1.9.1: PowerEdge T150, T350, R250, R350
- 1.4.3: PowerEdge T160, T360, R260, R360
- 1.8.0: PowerEdge R860, R960, XE9680 and related models
Dell notes BIOS 1.7.6 on 16th generation E5 platforms was replaced by 1.8.0 because of a functional issue, and recommends 1.8.0 for those customers. The advisory lists one AMD entry as "Before 2.14.1", which looks like a typo for the same pattern. Check your model there.
How to check if you're exposed
Read the BIOS version and model from the server.
racadm getsysinfo
You can also use the iDRAC web page or the boot time BIOS screen. Compare the version to the fixed version for your model in Dell's table. The table may not be complete, so confirm with Dell support if your model is not listed.
What to do now
- Identify PowerEdge and Precision Rack servers and their BIOS levels.
- Update to the fixed version listed for your model.
- For 16th generation E5 models, use 1.8.0 as Dell advises, not the replaced 1.7.6.
- Plan reboots in a maintenance window and verify the version afterwards.
Why it matters
The record lists CWE-119, memory buffer bounds errors, and CWE-787, out of bounds write. SMM code runs with very high privilege and its memory (SMRAM) is protected. When the code trusts a buffer from the operating system without checking its size and location, reads and writes can go outside the intended area.
This CVE is the sibling of CVE-2024-0161, which Dell fixes in a different advisory and BIOS set. The score of 5.3 is lower because of the vector, with low confidentiality, integrity and availability impact. No exploitation in the wild is shown in the record. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Why is the score lower than CVE-2024-0161?
The vectors differ. CVE-2024-0162 has low impact ratings and needs only low privileges, while 0161 has high integrity and availability impact.
Is a workaround available?
Dell lists none. Update the BIOS.
Sources
Last reviewed: 19 October 2026.
