CVE-2021-43323: High severity Insyde InsydeH2O vulnerability
An issue was discovered in UsbCoreDxe in Insyde InsydeH2O with kernel 5.5 before 05.51.45, 5.4 before 05.43.45, 5.3 before 05.35.45, 5.2 before 05.26.45, 5.1 before 05.16.45, and 5.0 before 05.08.45. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue in InsydeH2O with kernel 5.5 before 05.51.45?
The vulnerability ID for this issue is CVE-2021-43323.
What is the severity of CVE-2021-43323?
The severity of CVE-2021-43323 is high with a CVSS score of 8.2.
What is the affected software version range for CVE-2021-43323?
The affected software version range for CVE-2021-43323 is from 5.5 before 05.51.45.
What is the potential impact of CVE-2021-43323?
CVE-2021-43323 allows an attacker to hijack execution flow of code running in System Management Mode (SMM).
Are there any references related to CVE-2021-43323?
Yes, you can find more information about CVE-2021-43323 in the following references: [reference 1](https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf), [reference 2](https://security.netapp.com/advisory/ntap-20220217-0013/), [reference 3](https://www.insyde.com/security-pledge).