NexaPulse
Subscribe
7.5highHigh

CVE-2021-33625

Insyde Insydeh2o

An issue was discovered in Kernel 5.x in Insyde InsydeH2O, affecting HddPassword. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is requires local access to the machine.
  • For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
  • To exploit it, an administrative account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
7.5 (v3.1)
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-119
Assigned by
cve@mitre.org

Dates

Published
2022-02-03
Last modified
2026-08-11
Sources
NVD

Affected products

  • Insyde Insydeh2o5.1 - 5.16.23, 5.2 - 5.26.23, 5.3 - 5.35.23, 5.4 - 5.43.22, 5.5 - 5.51.22
  • Netapp Fas\/Aff Biosall versions
  • Siemens Ruggedcom Ape1808 Firmwareall versions
  • Siemens Ruggedcom Ape1808all versions
  • Siemens Simatic Field Pg M5 Firmwareall versions
  • Siemens Simatic Field Pg M5all versions
  • Siemens Simatic Ipc127e Firmwareall versions
  • Siemens Simatic Ipc127eall versions
  • Siemens Simatic Itp1000 Firmwareall versions
  • Siemens Simatic Itp1000all versions
  • Siemens Simatic Ipc277g Firmwareall versions
  • Siemens Simatic Ipc277gall versions

As listed in the NVD configuration data. Not a statement about your estate.

References