CVE-2015-0949 describes a critical vulnerability in the System Management Mode (SMM) implementation of Dell Latitude E6430 and HP EliteBook 850 G1 BIOS, allowing local users with physical memory write access to bypass Secure Boot and gain elevated privileges. This flaw stems from the SMM not properly restricting function calls to SMRAM. Rated with a CVSS score of 7.8 (High), the vulnerability has a low attack complexity and requires local access, but can lead to complete compromise of confidentiality, integrity, and availability. The potential impact is significant, enabling attackers to subvert the system's security mechanisms. While the vulnerability is not listed in CISA's KEV catalog and no public exploit code (Metasploit, Nuclei, ExploitDB) is available, it has garnered some community discussion and media coverage, including an article linking it to UEFI bootkits. Its EPSS score is very low, suggesting a minimal probability of exploitation in the wild.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
a09CPE matchmatch criteria | cpe:2.3:o:dell:latitude_e6430_firmware:a09:*:*:*:*:*:*:* | ||
01.09CPE matchmatch criteria | cpe:2.3:o:hp:elitebook_850_g1_firmware:01.09:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.