CVE-2019-12532

Published: Aug 26, 2019Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08.

Affected (8)

Products: Insyde: H2oelv, H2offt, H2ooae, H2opcm, H2osde, H2ouve

6 products

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Insyde H2oelv	version < 100.00.02.08
Insyde H2offt	100.00.00.00 ≤ version ≤ 100.00.08.23
Insyde H2offt	200.00.00.01 ≤ version ≤ 200.00.00.05
Insyde H2offt	3.02 ≤ version ≤ 5.28
Insyde H2ooae	version < 200.00.00.02
Insyde H2opcm	version < 100.00.06.00
Insyde H2osde	version < 200.00.00.07
Insyde H2ouve	version < 200.00.02.02