CVE-2020-5953

HIGH 7.5CVE-2020-5953 · Published 03/02/2022 · updated 11/08/2026

In short

CVE-2020-5953 is a HIGH (CVSS 7.5) vulnerability affecting insydeh2o (insyde).
Chance of exploitation in the next 30 days (EPSS): 0.28%, higher than 20.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
insydeh2o insyde	`= 5.12.09.0074= 5.23.04.0045= 5.23.45.0023= 5.33.15.0034= 5.34.03.0029= 5.42.03.0010`	No fix yet

Description

A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).

References

cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Third Party Advisory
security.netapp.com/advisory/ntap-20220222-0005 · Third Party Advisory
insyde.com/products · Product
insyde.com/security-pledge · Vendor Advisory
kb.cert.org/vuls/id/796611
cert-portal.siemens.com/productcert/html/ssa-306654.html

More vulnerabilities in insydeh2o

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

insydeh2o

insyde

= 5.12.09.0074= 5.23.04.0045= 5.23.45.0023= 5.33.15.0034= 5.34.03.0029= 5.42.03.0010

No fix yet

Description

More vulnerabilities in insydeh2o

See all →