8.2

CVE-2022-35893

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM memory corruption vulnerability in the FvbServicesRuntimeDxe driver allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Data is provided by the National Vulnerability Database (NVD)
Insyde ≫ Insydeh2o Version >= 5.0 < 05.09.37
Insyde ≫ Insydeh2o Version >= 5.1 < 05.17.37
Insyde ≫ Insydeh2o Version >= 5.2 < 05.27.29
Insyde ≫ Insydeh2o Version >= 5.3 < 05.36.29
Insyde ≫ Insydeh2o Version >= 5.4 < 05.44.29
Insyde ≫ Insydeh2o Version >= 5.5 < 05.52.29
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.09% 0.269
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.2 1.5 6
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 8.2 1.5 6
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.