CVE-2023-27373
MEDIUMInsyde InsydeH2O 5.0-5.5 - Improper Input Validation in EFI Variable Handling
Title source: llmDescription
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Due to insufficient input validation, an attacker can tamper with a runtime-accessible EFI variable to cause a dynamic BAR setting to overlap SMRAM.
References (1)
Core 1
Core References
Vendor Advisory
https://www.insyde.com/security-pledge/SA-2023035
Scores
CVSS v3
5.5
EPSS
0.0017
EPSS Percentile
6.8%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-20
Status
published
Products (6)
insyde/insydeh2o
5.0
insyde/insydeh2o
5.1
insyde/insydeh2o
5.2
insyde/insydeh2o
5.3
insyde/insydeh2o
5.4
insyde/insydeh2o
5.5
Published
Aug 07, 2023
Tracked Since
Feb 18, 2026