7.5
CVE-2020-5953
- EPSS 0.29%
- Published 03.02.2022 01:15:07
- Last modified 21.11.2024 05:34:53
- Source cve@mitre.org
- Teams watchlist Login
- Open Login
A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).
Data is provided by the National Vulnerability Database (NVD)
Siemens ≫ Ruggedcom Ape1808 Firmware Version-
Siemens ≫ Simatic Field Pg M6 Firmware Version-
Siemens ≫ Simatic Ipc127e Firmware Version-
Siemens ≫ Simatic Ipc227g Firmware Version-
Siemens ≫ Simatic Ipc277g Firmware Version-
Siemens ≫ Simatic Itp1000 Firmware Version-
Siemens ≫ Simatic Ipc477e Pro Firmware Version-
Siemens ≫ Simatic Ipc627e Firmware Version-
Siemens ≫ Simatic Ipc647e Firmware Version-
Siemens ≫ Simatic Ipc677e Firmware Version-
Siemens ≫ Simatic Ipc847e Firmware Version-
Siemens ≫ Simatic Ipc327g Firmware Version-
Siemens ≫ Simatic Ipc377g Firmware Version-
Siemens ≫ Simatic Ipc427e Firmware Version-
Siemens ≫ Simatic Ipc477e Firmware Version-
Siemens ≫ Simatic Field Pg M5 Firmware Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.29% | 0.523 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 0.8 | 6 |
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
|
| nvd@nist.gov | 6.9 | 3.4 | 10 |
AV:L/AC:M/Au:N/C:C/I:C/A:C
|