Insyde InsydeH2O permission permission and access control issues vulnerability (CNVD-2022-10274)

2022-02-0900:00:00

China National Vulnerability Database

www.cnvd.org.cn

0.0004 Low

EPSS

Percentile

5.1%

JSON

Insyde InsydeH2O is a C source from Insyde Software (Taiwan, China) that implements the new technology “EFI/UEFI” specification, designed to replace the traditional BIOS (Basic Input/Output System). Operating System (H2O) UEFI firmware is vulnerable to permission and access control issues, which can be exploited to hijack the execution flow of code running in system management mode.

CPENameOperatorVersion
insyde hddpasswordeq05.16.23
insyde hddpasswordeq05.23.22
insyde hddpasswordeq05.32.22

Name	Operator	Version
insyde hddpassword	eq	05.16.23
insyde hddpassword	eq	05.23.22
insyde hddpassword	eq	05.32.22

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CNVD-2022-10274