CVE-2021-33626

Katalog CVE

CVSS 7.8 · High EPSS 0,31%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada insydeh2o, siemens ruggedcom apr1808 firmware +15 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.

Rincian

Terbit di NVD

1 Oktober 2021

Terakhir diubah

11 Agustus 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.insyde.com/security-pledge advisory vendor
• https://www.insyde.com/security-pledge/SA-2021001 advisory vendor
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220216-0006/ advisory pihak ketiga
• https://www.kb.cert.org/vuls/id/796611
• https://cert-portal.siemens.com/productcert/html/ssa-306654.html