PT-2023-21738 · Insyde · Insydeh2O

Published 2023-08-03 · Updated 2023-08-09 · CVE-2023-28468

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O versions 5.0 through 5.5

Description An issue was discovered in FvbServicesRuntimeDxe, which is an SMM module that exposes an SMI handler. This handler allows an attacker to interact with the SPI flash at run-time from the OS.

Recommendations For versions 5.0 through 5.5, consider disabling the FvbServicesRuntimeDxe SMM module as a temporary workaround until a patch is available. Restrict access to the SMI handler to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-28468

Affected Products

Insydeh2O

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-28468 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28468 · Vendor Advisory
• https://insyde.com/security-pledge/SA-2023039 · Vendor Advisory
• https://insyde.com/security-pledge · Note
• https://t.me/cibsecurity/67687 · Telegram Post
• https://t.me/cvenotify/56169 · Telegram Post