CVE-2024-0172 is a high severity (CVSS 7.9) improper privilege management flaw in Dell PowerEdge Server BIOS and Dell Precision Rack BIOS. An unauthenticated local attacker could potentially escalate privileges. Dell fixes it with per model BIOS updates listed in advisory DSA-2024-035.
What's affected
Dell advisory DSA-2024-035 says all BIOS versions before the listed fixed version are affected. Examples:
- 1.5.6: PowerEdge R660, R760, R860, R960 and related models
- 1.11.2: PowerEdge R650, R750, R550, R450 and related models
- 1.7.3: PowerEdge T150, T350, R250, R350
- 2.12.4: PowerEdge R6515, R6525, R7515, R7525 and XE8545
- 2.19.1: PowerEdge R640, R740, R740XD, R940 and related models
Dell says the list may not be comprehensive and may be updated. Use the advisory for the full table.
How to check if you're exposed
Read the BIOS version and server model.
racadm getsysinfo
Then find the model in the advisory table and compare. The iDRAC interface shows the same data. For a large estate, export BIOS versions from iDRAC or your server management tool.
What to do now
- Collect the model and BIOS version for every PowerEdge and Precision Rack server.
- Apply the fixed BIOS for each model from Dell.
- Schedule reboots and keep a record of the new version.
- Restrict physical and console access to servers that cannot be updated yet.
Why it matters
The weakness is CWE-269, improper privilege management. Dell describes it as allowing an unauthenticated local attacker to gain more privilege than intended. The vector has no privileges required and a changed scope, which means the impact reaches beyond the vulnerable component.
The record does not give the exact mechanism, and Dell lists no workaround. We will not guess at details. Firmware flaws sit under the operating system, so the safest handling is a normal BIOS update cycle. No exploitation in the wild is shown in the record. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Does the attacker need credentials?
Dell describes an unauthenticated local attacker, so no login is needed, but local access is.
Where do I find the fix?
In the model table in Dell advisory DSA-2024-035, with download links for each model.
Sources
Last reviewed: 19 October 2026.
