CVE-2026-80357
Received Received - Intake

Dell BOSS-N1 SMCU Unauthorized Access Vulnerability

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Dell

Description
Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Unauthorized access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-80357
EUVD
EUVD-2026-88295

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dell boot_optimized_server_storage to 2.2.13.2038 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1191 The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dell BOSS versions before 2.2.13.2038 have an improper access control flaw in the On-Chip Debug and Test Interface on 17G BOSS-N1 controllers. This allows an unauthenticated attacker with physical access to gain unauthorized access to the system.

Detection Guidance

Detection requires physical inspection as this vulnerability involves physical access to the system. Check if your Dell BOSS-N1 controller is running firmware versions prior to 2.2.13.2038. Use the Dell EMC iDRAC or OpenManage tools to verify firmware versions on affected systems.

Impact Analysis

An attacker could exploit this to gain high-level access to the system, potentially leading to data theft, system manipulation, or disruption of services. Physical access is required, but no authentication is needed.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update the BOSS firmware to version 2.2.13.2038 or later immediately. Ensure physical access to the system is restricted to authorized personnel only. Disable any unnecessary debug interfaces if supported by the hardware.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80357. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart