Skip to content
OpenAdvisories
High WID-SEC-2025-1680 6 CVEs

Insyde BIOS (Lenovo): Mehrere Schwachstellen

Published Jul 29, 2025 · Updated Jul 29, 2025 · de-DE

Vendor: Insyde Software Vendor: Lenovo Product: BIOS Product: UEFI Firmware

Summary

Ein lokaler Angreifer mit hohen Rechten kann mehrere Schwachstellen in der Insyde UEFI Firmware und dem Lenovo BIOS ausnutzen, um beliebigen Code auszuführen, Daten zu manipulieren, vertrauliche Informationen preiszugeben oder nicht spezifizierte Angriffe durchzuführen.

Product

InsydeH2O UEFI BIOS ist eine proprietäre, lizenzierte UEFI-BIOS-Firmware, die Intel und AMD basierte Computer unterstützt.
Das BIOS ist die Firmware bei IBM PC kompatiblen Computern.

Vulnerabilities 6

  • High 8.2
    CVE-2025-4421

    EfiSmiServices: gEfiSmmCpuProtocol, SMM memory corruption vulnerabilities in SMM module

    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home

    Insyde Software InsydeH2O
  • High 8.2
    CVE-2025-4422

    EfiSmiServices : EfiPcdProtocol, SMM memory corruption vulnerabilities in SMM module

    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home

    Insyde Software InsydeH2O
  • High 8.2
    CVE-2025-4423

    SetupAutomationSmm:Vulnerability in the SMM module allow attacker to write arbitrary code and lead to memory corruption

    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home

    Insyde Software InsydeH2O
  • High 8.2
    CVE-2025-4425

    SetupAutomationSmm: Stack overflow vulnerability in SMI handler

    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home

    Insyde Software InsydeH2O
  • Medium 6.0
    CVE-2025-4424

    SetupAutomationSmm : Arbitrary calls to SmmSetVariable with unsanitised arguments in SMI handler

    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home

    Insyde Software InsydeH2O
  • Medium 6.0
    CVE-2025-4426

    SetupAutomationSmm : SMRAM memory contents leak / information disclosure vulnerability in SMM module

    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home

    Insyde Software InsydeH2O

Revision history

  1. #1

    Initiale Fassung

References