Summary
Ein lokaler Angreifer kann mehrere Schwachstellen in Insyde UEFI Firmware ausnutzen, um beliebigen Programmcode auszuführen.
Product
InsydeH2O UEFI BIOS ist eine proprietäre, lizenzierte UEFI-BIOS-Firmware, die Intel und AMD basierte Computer unterstützt.
Vulnerabilities 2
-
High 7.8CVE-2025-4275 Public exploit
SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate
A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed …
-
High 7.5
Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55…
Revision history
-
#3
Neue Updates von HP aufgenommen
-
#2
PoC für "Hydroph0bia" / CVE-2025-4275 aufgenommen
-
#1
Initiale Fassung
References
-
Insyde Security Advisory INSYDE-SA-2024018 vom 2025-06-10
https://www.insyde.com/security-pledge/sa-2024018/
-
Insyde Security Advisory INSYDE-SA-2025002 vom 2025-06-10
https://www.insyde.com/security-pledge/sa-2025002/
-
Lenovo Security Advisory LEN-197020 vom 2025-06-11
https://support.lenovo.com/us/en/product_security/LEN-197020
-
Coderush Blog vom 2025-06-11
https://coderush.me/hydroph0bia-part1/
-
Dell Security Advisory DSA-2025-149 vom 2025-06-11
https://www.dell.com/support/kbdoc/de-de/000299521/dsa-2025-149
-
HP Security Bulletin HPSBHF04070 vom 2025-10-09
https://support.hp.com/us-en/document/ish_13159700-13159730-16/HPSBHF04070