7.8

CVE-2021-33626

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Insyde ≫ Insydeh2o Version >= 5.3 < 5.34.44
Insyde ≫ Insydeh2o Version >= 5.2 < 5.25.44
Insyde ≫ Insydeh2o Version >= 5.1 < 5.16.25
Insyde ≫ Insydeh2o Version >= 5.4 < 5.42.44
Insyde ≫ Insydeh2o Version >= 5.3 < 5.35.25
Insyde ≫ Insydeh2o Version >= 5.2 < 5.26.25
Insyde ≫ Insydeh2o Version >= 5.4 < 5.43.25
Siemens ≫ Ruggedcom Apr1808 Firmware Version -
   Siemens ≫ Ruggedcom Apr1808 Version -
Siemens ≫ Simatic Ipc127e Firmware Version -
   Siemens ≫ Simatic Ipc127e Version -
Siemens ≫ Simatic Ipc227g Firmware Version -
   Siemens ≫ Simatic Ipc227g Version -
Siemens ≫ Simatic Ipc277g Firmware Version -
   Siemens ≫ Simatic Ipc277g Version -
Siemens ≫ Simatic Ipc327g Firmware Version -
   Siemens ≫ Simatic Ipc327g Version -
Siemens ≫ Simatic Ipc377g Firmware Version -
   Siemens ≫ Simatic Ipc377g Version -
Siemens ≫ Simatic Ipc427e Firmware Version -
   Siemens ≫ Simatic Ipc427e Version -
Siemens ≫ Simatic Ipc477e Firmware Version -
   Siemens ≫ Simatic Ipc477e Version -
Siemens ≫ Simatic Ipc627e Firmware Version -
   Siemens ≫ Simatic Ipc627e Version -
Siemens ≫ Simatic Ipc647e Firmware Version -
   Siemens ≫ Simatic Ipc647e Version -
Siemens ≫ Simatic Ipc677e Firmware Version -
   Siemens ≫ Simatic Ipc677e Version -
Siemens ≫ Simatic Ipc847e Firmware Version -
   Siemens ≫ Simatic Ipc847e Version -
Siemens ≫ Simatic Itp1000 Firmware Version -
   Siemens ≫ Simatic Itp1000 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.233
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0006/
Third Party Advisory
https://www.insyde.com/security-pledge
Vendor Advisory
https://www.kb.cert.org/vuls/id/796611
https://www.insyde.com/security-pledge/SA-2021001
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-306654.html