CVE-2020-5953
—CVSS 3.1
7.5 high
EPSS
<1%p21
Published
()
Modified
Description
A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).
- Vendors
- insydesiemens
- Products
- insydeh2o, ruggedcom ape1808 firmware, simatic field pg m6 firmware, simatic ipc127e firmware, simatic ipc227g firmware, simatic ipc277g firmware, simatic itp1000 firmware, simatic ipc477e pro firmware, simatic ipc627e firmware, simatic ipc647e firmware, simatic ipc677e firmware, simatic ipc847e firmware
- Vector
- CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.