CVE-2023-25600

low-risk

Published 2023-08-03

An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a denial of service. This is fixed in version 01.01.04.0016.

Do I need to act?

0.08% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.1/10 High

LOCAL / LOW complexity

Affected Products (1)

Insydecrpkg

Affected Vendors

Insyde

References (4)

Not Applicable https://www.insyde.com/security-pledge

Vendor Advisory https://www.insyde.com/security-pledge/SA-2023028

Not Applicable https://www.insyde.com/security-pledge

Vendor Advisory https://www.insyde.com/security-pledge/SA-2023028

/ 100

low-risk

Severity 22/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal