CVE-2023-25600

ALTO 7.1CVE-2023-25600 · Published 03/08/2023 · updated 17/06/2026

In breve

CVE-2023-25600 è una vulnerabilità ALTO (CVSS 7.1) che riguarda insydecrpkg (insyde).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.19%, superiore al 8.5% delle vulnerabilità.
Correzione: aggiornare a 01.01.04.0016 o successiva.

Package	Affected versions	Patched versions
insydecrpkg insyde	`< 01.01.04.0016`	`01.01.04.0016`

Description

An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a denial of service. This is fixed in version 01.01.04.0016.

References

insyde.com/security-pledge · Not Applicable
insyde.com/security-pledge/SA-2023028 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free