CVE-2023-28063
Dell Optiplex 3000 Micro Firmware
Raw vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-28063 is a medium-severity Signed to Unsigned Conversion Error (CWE-195) vulnerability in Dell Optiplex 3000 Micro Firmware. Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-31788
Vulnerability Data
Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover conversion errors through static analysis, fuzzing, or targeted unit tests.
Requiring documented development standards and tools can enforce coding rules that prohibit or safely wrap such casts.
Engineering principles can mandate safe integer handling and strong typing to avoid unsafe signed-to-unsigned casts.
Input validation directly stops malformed or out-of-range numeric values from reaching conversion logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (static analysis, code review, safe-integer standards) directly prevent signed-to-unsigned conversion errors.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development life cycle mandates practices that can catch signed-to-unsigned conversion errors during design and coding.
A.8.26 only requires that security requirements (including resilience against attacks such as buffer overflows or SQL injection) be identified and specified during development or acquisition; it does not itself enforce, implement, or prevent the signed-to-unsigned conversion error from arising or being exploitable.
A.8.27 mandates establishing and applying security engineering principles (e.g. least privilege, security by design, hardening) and design reviews during the SDLC; it does not stop a signed-to-unsigned conversion error from being exploitable if the flawed code is written and deployed.
Secure coding standards directly prohibit unsafe signed-to-unsigned casts and require defensive checks.
Security testing in development can detect conversion-related defects before release.