PT-2025-25335 · Insyde · Insydeh2O

Published 2025-06-12 · Updated 2025-10-12 · CVE-2024-55567

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AC:H/AV:L/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O kernel versions 5.4 through 05.46.01 Insyde InsydeH2O kernel versions 5.5 through 05.54.01 Insyde InsydeH2O kernel versions 5.6 through 05.61.01 Insyde InsydeH2O kernel versions 5.7 through 05.70.01

Description Improper input validation was discovered in UsbCoreDxe, which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. The SMM module has an SMM call out vulnerability.

Recommendations For Insyde InsydeH2O kernel versions 5.4 through 05.46.01, update to version 05.47.01 or later. For Insyde InsydeH2O kernel versions 5.5 through 05.54.01, update to version 05.55.01 or later. For Insyde InsydeH2O kernel versions 5.6 through 05.61.01, update to version 05.62.01 or later. For Insyde InsydeH2O kernel versions 5.7 through 05.70.01, update to version 05.71.01 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-55567

Affected Products

Insydeh2O

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-55567 · Security Note
• https://insyde.com/security-pledge/sa-2024018 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55567 · Vendor Advisory
• https://reddit.com/r/YogaPro9i/comments/1mx74rq/new_bios_update_for_gen_9_contains_nothing · Reddit Post
• https://t.me/cveNotify/132928 · Telegram Post
• https://twitter.com/CVEnew/status/1933205133510271326 · Twitter Post
• https://twitter.com/cracbot/status/1934929076462219558 · Twitter Post
• https://t.me/cvetracker/26110 · Telegram Post
• https://t.me/cvenotify/126007 · Telegram Post
• https://reddit.com/r/LenovoLegion/comments/1o4m9cr/neues_bios_update_kwcn51ww_gen8_ger%C3%A4te · Reddit Post
• https://t.me/cvenotify/125780 · Telegram Post