Insyde InsydeH2O permission permission and access control issues vulnerability (CNVD-2022-10276)

2022-02-0900:00:00

China National Vulnerability Database

www.cnvd.org.cn

0.001 Low

EPSS

Percentile

22.1%

JSON

Insyde InsydeH2O is a C source from Insyde Software (Taiwan, China) that implements the new technology “EFI/UEFI” specification, designed to replace the legacy BIOS (Basic Input/Output System). Operating System (H2O) UEFI firmware is vulnerable to permission and access control issues, which can be exploited to hijack the execution flow of code running in system management mode.

CPENameOperatorVersion
insyde usbcoredxeeq05.08.45
insyde usbcoredxeeq05.16.45
insyde usbcoredxeeq05.26.45
insyde usbcoredxeeq05.35.45
insyde usbcoredxeeq05.43.45
insyde usbcoredxeeq05.51.45

Name	Operator	Version
insyde usbcoredxe	eq	05.08.45
insyde usbcoredxe	eq	05.16.45
insyde usbcoredxe	eq	05.26.45
insyde usbcoredxe	eq	05.35.45
insyde usbcoredxe	eq	05.43.45
insyde usbcoredxe	eq	05.51.45

0.001 Low

EPSS

Percentile

22.1%

JSON

Related for CNVD-2022-10276