CVE-2026-80357

highpriority · track · 0EPSS 0.001 · 1 %ile

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.11% (1st) EPSS

CVSS 7 · high

Is it mine?

0 products

Check your exposure

Who says so?

— sources

EPSS · scored 2026-10-26

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Unauthorized access.

cvss

Technical severity, 0–10. One row per scoring source.

7.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.4–7

v3.17highCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · security_alert@emc.comexploitability 0.4 · impact 6

v3.16.4mediumCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1191USprimary

affected products

Products and version ranges known to be affected.

No affected products recorded.

sources

Which sources assert this record, and when.

NVD CVE.org MITRE

published 2026-09-28modified 2026-09-28

related (32)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2022-43096US	medium6.8	0.55% (46th)	Exploit	2022-11-17
Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port.
CVE-2026-8989US	medium6.8	0.24% (15th)	—	2026-07-21
Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical acc…
CVE-2026-8988US	medium6.8	0.24% (15th)	—	2026-07-21
Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attac…
CVE-2025-47822US	medium6.8	0.26% (17th)	—	2025-06-27
Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control.
CVE-2025-47819US	medium6.8	0.26% (18th)	—	2025-06-27
Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control.

+27 more

references (1) nvd

External citations — patches, advisories, analysis.

https://www.dell.com/support/kbdoc/en-us/000513073/dsa-2026-402-security-update-for-dell-boot-optimized-server-storage-boss-vulnerability

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan