Driver Vulnerability in InsydeH2O Firmware
CVE-2022-46897

5.3MEDIUM

Key Information:

Vendor

Insyde Software

Status
Kernel
Vendor
CVE Published:
22 April 2024

What is CVE-2022-46897?

An issue exists in the InsydeH2O firmware, specifically within the CapsuleIFWUSmm driver, which fails to properly check return values from methods or functions. This oversight may lead to an inability to detect unexpected states or conditions, potentially allowing for unauthorized actions or system instability. Addressing this vulnerability is crucial for maintaining system security and ensuring robust operational integrity.

References

https://www.insyde.com/security-pledge

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.