CVSS 3.1
8.2 highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HCVE-2021-33627
High (8.2). EPSS 0.3% chance of exploitation in the next 30 days.
An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1 before 05.17.11, 5.2 before 05.27.11, 5.3 before 05.36.11, 5.4 before 05.44.11, and 5.5 before 05.52.11 affecting FwBlockServiceSmm. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
- CWE
- CWE-119
- Published
- Modified
- Record from
- the NVD, synced
Affected
- insyde:insydeh2o
- siemens:simatic_field_pg_m5_firmware
- siemens:simatic_field_pg_m6_firmware
- siemens:simatic_ipc127e_firmware
- siemens:simatic_ipc227g_firmware
- siemens:simatic_ipc277g_firmware
- siemens:simatic_ipc327g_firmware
- siemens:simatic_ipc377g_firmware
- siemens:simatic_ipc427e_firmware
- siemens:simatic_ipc477e_firmware
- siemens:simatic_ipc627e_firmware
- siemens:simatic_ipc647e_firmware
- siemens:simatic_ipc677e_firmware
- siemens:simatic_ipc847e_firmware
- siemens:simatic_itp1000_firmware