NexaPulse
Subscribe
7.5highHigh

CVE-2020-5953

Insyde Insydeh2o

A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is requires local access to the machine.
  • For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
  • To exploit it, an administrative account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
7.5 (v3.1)
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Assigned by
cve@mitre.org

Dates

Published
2022-02-03
Last modified
2026-08-11
Sources
NVD

Affected products

  • Insyde Insydeh2o5.12.09.0074, 5.23.04.0045, 5.23.45.0023, 5.33.15.0034, 5.34.03.0029, 5.42.03.0010
  • Siemens Ruggedcom Ape1808 Firmwareall versions
  • Siemens Ruggedcom Ape1808all versions
  • Siemens Simatic Field Pg M6 Firmwareall versions
  • Siemens Simatic Field Pg M6all versions
  • Siemens Simatic Ipc127e Firmwareall versions
  • Siemens Simatic Ipc127eall versions
  • Siemens Simatic Ipc227g Firmwareall versions
  • Siemens Simatic Ipc227gall versions
  • Siemens Simatic Ipc277g Firmwareall versions
  • Siemens Simatic Ipc277gall versions
  • Siemens Simatic Itp1000 Firmwareall versions

As listed in the NVD configuration data. Not a statement about your estate.

References