CVE-2021-43613

Published: Sep 3, 2026Modified: Sep 3, 2026

6.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Exploitability: 2.0 / Impact: 4.0

Source: 8338d8cb-57f7-4252-abc0-96fd13e98d21 (Secondary)

Description

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

Related CWEs

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (1)

https://www.insyde.com/security-pledge/sa-2022027/

Source: 8338d8cb-57f7-4252-abc0-96fd13e98d21

Timeline

No history available yet.