Not rated
CVE-2020-5953 A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI…
Description
A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| n/a | Versions not published | |
| SIMATIC Field PG M5 22.01 | earliest → < 22.01.10 | 22.01.10 |
| SIMATIC Field PG M6 26.01 | earliest → < 26.01.13 | 26.01.13 |
| SIMATIC IPC127E 27.01 | earliest → < 27.01.09 | 27.01.09 |
| SIMATIC IPC227G 28.01 | earliest → < 28.01.04 | 28.01.04 |
| SIMATIC IPC277G 28.01 | earliest → < 28.01.04 | 28.01.04 |
| SIMATIC IPC277G PRO 28.01 | earliest → < 28.01.04 | 28.01.04 |
| SIMATIC IPC327G 28.01 | earliest → < 28.01.04 | 28.01.04 |
| SIMATIC IPC377G 28.01 | earliest → < 28.01.04 | 28.01.04 |
Show the 9 other branches Hide the 9 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| SIMATIC IPC427E 21.01 | earliest → < 21.01.17 | 21.01.17 |
| SIMATIC IPC477E 21.01 | earliest → < 21.01.17 | 21.01.17 |
| SIMATIC IPC477E PRO 21.01 | earliest → < 21.01.17 | 21.01.17 |
| SIMATIC IPC627E 25.02 | earliest → < 25.02.12 | 25.02.12 |
| SIMATIC IPC647E 25.02 | earliest → < 25.02.12 | 25.02.12 |
| SIMATIC IPC677E 25.02 | earliest → < 25.02.12 | 25.02.12 |
| SIMATIC IPC847E 25.02 | earliest → < 25.02.12 | 25.02.12 |
| SIMATIC ITP1000 23.01 | earliest → < 23.01.10 | 23.01.10 |
| SIPLUS IPC427E 21.01 | earliest → < 21.01.17 | 21.01.17 |
References
- www.insyde.com www.insyde.com
- www.insyde.com www.insyde.com
- cert-portal.siemens.com cert-portal.siemens.com
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of n/a
The 144658 CVEs of n/a →
CVE-2026-106713
An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the…
Not rated
CVE-2026-106715
NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin…
Not rated
CVE-2026-106714
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it…
Not rated
CVE-2026-106716
ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep…
Not rated