Password Hash Exposure in InsydeH2O Firmware by Insyde Technologies
CVE-2021-43613

6.5MEDIUM

Key Information:

Vendor

Insyde Software

Status
Insydeh2o
Vendor
CVE Published:
3 September 2026

What is CVE-2021-43613?

An issue was identified within the SysPasswordDxe component of InsydeH2O firmware, developed by Insyde Technologies. This vulnerability allows both user and administrator password hashes to be exposed through runtime UEFI variables, creating a pathway for elevation of privileges. If exploited, this vulnerability could enable attackers to gain unauthorized access to administrative-level functions, potentially compromising system security.

Affected Version(s)

InsydeH2O x86 See in the Solution

References

https://www.insyde.com/security-pledge/sa-2022027/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.