CVE-2021-41840

8.2 highEPSS 0.3%

High (8.2) in insyde insydeh2o. EPSS 0.3% chance of exploitation in the next 30 days.

An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere.

Severity

CVSS 3.1

8.2 high

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-770
Published: 2022-02-03
Modified: 2026-08-11
Record from: the NVD, synced 2026-10-19

Affected

insyde:insydeh2o

References

https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
https://security.netapp.com/advisory/ntap-20220217-0014/
https://www.insyde.com/security-pledge
https://www.insyde.com/security-pledge/SA-2022018
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf

Check your stack JSON