Plaintext HDD Password Storage in UEFI Variable for Insyde Products
CVE-2021-38489
8.2HIGH
What is CVE-2021-38489?
The identified vulnerability involves the insecure storage of hard disk drive (HDD) passwords in plaintext within a UEFI variable in InsydeH2O firmware. This design flaw exposes stored passwords to unauthorized access, potentially leading to system compromise. Ensuring that sensitive information is adequately protected is crucial for maintaining the integrity and confidentiality of devices relying on Insyde's firmware.
Affected Version(s)
InsydeH2O x86 See in the Solution
References
CVSS V3.1
Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Insyde Software would like to thank Binarly for reporting this issue.