CVE-2023-28468

low-risk

Published 2023-08-03

An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Kernel

Affected Vendors

Insyde

References (4)

Not Applicable https://www.insyde.com/security-pledge

Vendor Advisory https://www.insyde.com/security-pledge/SA-2023039

Not Applicable https://www.insyde.com/security-pledge

Vendor Advisory https://www.insyde.com/security-pledge/SA-2023039

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal