PT-2023-21738 · Insyde · Insydeh2O

Publicado 2023-08-03 · Atualizado 2023-08-09 · CVE-2023-28468

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O versions 5.0 through 5.5

Description An issue was discovered in FvbServicesRuntimeDxe, which is an SMM module that exposes an SMI handler. This handler allows an attacker to interact with the SPI flash at run-time from the OS.

Recommendations For versions 5.0 through 5.5, consider disabling the FvbServicesRuntimeDxe SMM module as a temporary workaround until a patch is available. Restrict access to the SMI handler to minimize the risk of exploitation.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-28468

Produtos afetados

Insydeh2O

Referências · 6

• https://insyde.com/security-pledge · Nota
• https://t.me/cibsecurity/67687 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-28468 · Nota de Segurança
• https://t.me/cvenotify/56169 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28468 · Aviso do Fabricante
• https://insyde.com/security-pledge/SA-2023039 · Aviso do Fabricante