Log in / Sign up

Vulnerability details

CVE-2025-4277

Insyde Software InsydeH2O

Tcg2Smm: improper input validation may lead to arbitrary code execution

CVSS 3.1
7.5High

Official description

Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.

CVSS scores

ScoreVersionSourceVector
7.5High 3.1 CVEProject cvelistV5 (CNA) (Insyde) CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
Insyde Software InsydeH2O Kernel 5.2 ≤ v < 05.2A.21 CVEProject cvelistV5 (CNA)
Insyde Software InsydeH2O Kernel 5.3 ≤ v < 05.39.21 CVEProject cvelistV5 (CNA)
Insyde Software InsydeH2O Kernel 5.4 ≤ v < 05.47.21 CVEProject cvelistV5 (CNA)
Insyde Software InsydeH2O Kernel 5.5 ≤ v < 05.55.21 CVEProject cvelistV5 (CNA)
Insyde Software InsydeH2O Kernel 5.6 ≤ v < 05.62.21 CVEProject cvelistV5 (CNA)
Insyde Software InsydeH2O Kernel 5.7 ≤ v < 05.71.21 CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2025-08-13
Last updated
2025-08-14
State
Published
Assigner (CNA)
Insyde

Exploit prediction (EPSS)

0.15%
Probability of exploitation in 30 days
4.4%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-20
    Improper Input Validation