Vulnerability-Lookup

CVE-2021-45970 (GCVE-0-2021-45970)

Vulnerability from cvelistv5 – Published: 2022-01-05 22:59 – Updated: 2026-08-11 12:22

Summary

An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location).

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 29/100 over 2324 records in the last 180 days details

References

5 references

URL	Tags
https://www.insyde.com/security-pledge	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2022021…	x_refsource_CONFIRM
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
https://www.kb.cert.org/vuls/id/796611
https://cert-portal.siemens.com/productcert/html/…

Impacted products

18 products

Vendor	Product	Version	CPE status
Siemens	RUGGEDCOM APE1808 - BIOS	Affected: 0 , < V1.0.202N (custom)	guessed
Siemens	SIMATIC Field PG M5	Affected: 0 , < V22.01.10 (custom)	guessed
Siemens	SIMATIC Field PG M6	Affected: 0 , < V26.01.13 (custom)	guessed
Siemens	SIMATIC IPC127E	Affected: 0 , < V27.01.09 (custom)	guessed
Siemens	SIMATIC IPC227G	Affected: 0 , < V28.01.04 (custom)	guessed
Siemens	SIMATIC IPC277G	Affected: 0 , < V28.01.04 (custom)	guessed
Siemens	SIMATIC IPC277G PRO	Affected: 0 , < V28.01.04 (custom)	guessed
Siemens	SIMATIC IPC327G	Affected: 0 , < V28.01.04 (custom)	guessed
Siemens	SIMATIC IPC377G	Affected: 0 , < V28.01.04 (custom)	guessed
Siemens	SIMATIC IPC427E	Affected: 0 , < V21.01.17 (custom)	guessed
Siemens	SIMATIC IPC477E	Affected: 0 , < V21.01.17 (custom)	guessed
Siemens	SIMATIC IPC477E PRO	Affected: 0 , < V21.01.17 (custom)	guessed
Siemens	SIMATIC IPC627E	Affected: 0 , < V25.02.12 (custom)	guessed
Siemens	SIMATIC IPC647E	Affected: 0 , < V25.02.12 (custom)	guessed
Siemens	SIMATIC IPC677E	Affected: 0 , < V25.02.12 (custom)	guessed
Siemens	SIMATIC IPC847E	Affected: 0 , < V25.02.12 (custom)	guessed
Siemens	SIMATIC ITP1000	Affected: 0 , < V23.01.10 (custom)	guessed
Siemens	SIPLUS IPC427E	Affected: 0 , < V21.01.17 (custom)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T19:12:48.530Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.insyde.com/security-pledge"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220216-0004/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf"
          },
          {
            "url": "https://www.kb.cert.org/vuls/id/796611"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM APE1808 - BIOS",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.0.202N",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC Field PG M5",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V22.01.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC Field PG M6",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V26.01.13",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC127E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V27.01.09",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC227G",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V28.01.04",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC277G",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V28.01.04",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC\u00a0IPC277G PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V28.01.04",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC327G",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V28.01.04",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC377G",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V28.01.04",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC427E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V21.01.17",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC477E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V21.01.17",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC477E PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V21.01.17",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC627E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V25.02.12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC647E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V25.02.12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC677E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V25.02.12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC847E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V25.02.12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC ITP1000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V23.01.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS IPC427E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V21.01.17",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T12:22:25.252Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-306654.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-22T19:06:32.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.insyde.com/security-pledge"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220216-0004/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-45970",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.insyde.com/security-pledge",
              "refsource": "MISC",
              "url": "https://www.insyde.com/security-pledge"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220216-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220216-0004/"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-45970",
    "datePublished": "2022-01-05T22:59:10.000Z",
    "dateReserved": "2022-01-01T00:00:00.000Z",
    "dateUpdated": "2026-08-11T12:22:25.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-45970",
      "date": "2026-10-26",
      "epss": "0.00326",
      "percentile": "0.2543"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "n/a",
                "vendor": "n/a",
                "versions": [
                  {
                    "status": "affected",
                    "version": "n/a"
                  }
                ]
              }
            ],
            "source": "cve@mitre.org"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "RUGGEDCOM APE1808 - BIOS",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V1.0.202N",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC Field PG M5",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V22.01.10",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC Field PG M6",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V26.01.13",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC127E",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V27.01.09",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC227G",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V28.01.04",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC277G",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V28.01.04",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC\u00a0IPC277G PRO",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V28.01.04",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC327G",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V28.01.04",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC377G",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V28.01.04",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC427E",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V21.01.17",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC477E",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V21.01.17",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC477E PRO",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V21.01.17",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC627E",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V25.02.12",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC647E",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V25.02.12",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC677E",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V25.02.12",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC IPC847E",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V25.02.12",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC ITP1000",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V23.01.10",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIPLUS IPC427E",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V21.01.17",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A6D01558-E38E-4A46-94A7-6F43BECA2599",
                    "versionEndExcluding": "5.16.25",
                    "versionStartIncluding": "5.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1E8E5C28-ACA1-46AC-B0C0-958B7805F75A",
                    "versionEndExcluding": "5.26.25",
                    "versionStartIncluding": "5.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6AA45E92-34FA-4583-938D-2139F870034F",
                    "versionEndExcluding": "5.35.25",
                    "versionStartIncluding": "5.3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "81782BA4-3BE8-4C12-BBA1-584C7EF98358",
                    "versionEndExcluding": "5.43.25",
                    "versionStartIncluding": "5.4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6EC229D4-4C67-4B44-ACEE-48DB31C87C4C",
                    "versionEndExcluding": "05.51.25",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location)."
          },
          {
            "lang": "es",
            "value": "Se ha detectado un problema en IdeBusDxe en InsydeH2O con el kernel 5.1 anteriores a 05.16.25, 5.2 anteriores a 05.26.25, 5.3 anteriores a 05.35.25, 5.4 anteriores a 05.43.25 y 5.5 anteriores a 05.51.25. Se presenta una vulnerabilidad en la rama SMM (System Management Mode) que registra un manejador SWSMI que no comprueba ni valida suficientemente el puntero del buffer asignado (el c\u00f3digo de estado guardado en la ubicaci\u00f3n CommBuffer+4)."
          }
        ],
        "id": "CVE-2021-45970",
        "lastModified": "2026-08-11T13:17:22.860",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 7.2,
                "confidentialityImpact": "COMPLETE",
                "integrityImpact": "COMPLETE",
                "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 10.0,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.5,
              "impactScore": 6.0,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-01-05T23:15:08.887",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220216-0004/"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.insyde.com/security-pledge"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220216-0004/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.insyde.com/security-pledge"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.kb.cert.org/vuls/id/796611"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-306654.html"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-29T04:19:29+00:00",
      "cve": "CVE-2021-45970",
      "id": "CVE-2021-45970",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2021-45970",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-45970.json",
      "version": "3"
    }
  }
}

BDU:2022-01018 (CVE-2021-45970)

Vulnerability from fstec – Published: 2022-03-01 – Updated: 2022-03-01 – View on bdu.fstec.ru Fixed

Title

Уязвимость компонента IdeBusDxe фреймворка для создания UEFI-прошивок InsydeH2O , связанная с записью за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код в целевой системе

Summary

Уязвимость компонента IdeBusDxe фреймворка для создания UEFI-прошивок InsydeH2O связана с записью за границами буфера в памяти. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код в целевой системе

Severity

7.2 (High) CVSS 2.0


                      
                        AV:L/AC:L/Au:N/C:C/I:C/A:C

7.4 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-787 - Запись за границами буфера

Aliases

CVE-2021-45970

References

3 references

URL
https://www.insyde.com/security-pledge
https://security.netapp.com/advisory/ntap-20220216-0004/
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf

Impacted products

1 product from 1 vendor

Vendors

Insyde

Products

InsydeH2O

Versions

от 5.1 до 5.16.25 (InsydeH2O), от 5.2 до 5.26.25 (InsydeH2O), от 5.3 до 5.35.25 (InsydeH2O), от 5.4 до 5.43.25 (InsydeH2O), от 5.5 до 05.51.25 (InsydeH2O)

Product types

Application software

Mitigations

Использование рекомендаций: https://www.insyde.com/security-pledge

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Insyde",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 5.1 \u0434\u043e 5.16.25 (InsydeH2O), \u043e\u0442 5.2 \u0434\u043e 5.26.25 (InsydeH2O), \u043e\u0442 5.3 \u0434\u043e 5.35.25 (InsydeH2O), \u043e\u0442 5.4 \u0434\u043e 5.43.25 (InsydeH2O), \u043e\u0442 5.5 \u0434\u043e 05.51.25 (InsydeH2O)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://www.insyde.com/security-pledge",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "05.01.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "01.03.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "01.03.2022",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2022-01018",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2021-45970",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "InsydeH2O",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 IdeBusDxe \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a InsydeH2O , \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0417\u0430\u043f\u0438\u0441\u044c \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 (CWE-787)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 IdeBusDxe \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f UEFI-\u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a InsydeH2O \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.insyde.com/security-pledge\nhttps://security.netapp.com/advisory/ntap-20220216-0004/\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-787",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,2)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,4)"
}

CERTFR-2022-AVI-180

Vulnerability from certfr_avis - Published: 2022-02-23 - Updated: 2022-02-23

De multiples vulnérabilités ont été découvertes dans Siemens . Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Siemens	N/A	SIMATIC IPC327G toutes versions
Siemens	N/A	SIMATIC IPC847E toutes versions
Siemens	N/A	SIMATIC ITP1000 toutes versions
Siemens	N/A	SIMATIC IPC277G toutes versions
Siemens	N/A	SIMATIC IPC427E toutes versions
Siemens	N/A	SIMATIC IPC477E toutes versions
Siemens	N/A	SIMATIC IPC227G toutes versions
Siemens	N/A	SIMATIC IPC377G toutes versions
Siemens	N/A	SIMATIC IPC627E toutes versions
Siemens	N/A	SIMATIC IPC647E toutes versions
Siemens	N/A	SIMATIC IPC127E toutes versions
Siemens	N/A	SIMATIC Field PG M6 toutes versions
Siemens	N/A	SIMATIC Field PG M5 toutes versions
Siemens	N/A	SIMATIC IPC677E toutes versions

References

Title

Publication Time

CNVD-2022-10290

Vulnerability from cnvd - Published: 2022-02-15

Title

Insyde InsydeH2O缓冲区溢出漏洞（CNVD-2022-10290）

Description

Insyde InsydeH2O是中国台湾系微（Insyde）公司的一个C语言源，它实现了新技术“EFI/UEFI”规范，旨在取代传统的BIOS（基本输入/输出系统）。 Insyde InsydeH2O存在缓冲区溢出漏洞，该漏洞源于SWSMI处理程序未充分检查或验证分配的缓冲区指针。目前没有详细漏洞细节提供。

Severity

高

Patch Name

Insyde InsydeH2O缓冲区溢出漏洞（CNVD-2022-10290）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.insyde.com/security-pledge

Reference

https://www.insyde.com/security-pledge

Impacted products

Name
['Insyde InsydeH2O 5.1，<05.16.25', 'Insyde InsydeH2O 5.2，<05.26.25', 'Insyde InsydeH2O 5.3，<05.35.25', 'Insyde InsydeH2O 5.4，<05.43.25', 'Insyde InsydeH2O 5.5，<05.51.25']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-45970",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-45970"
    }
  },
  "description": "Insyde InsydeH2O\u662f\u4e2d\u56fd\u53f0\u6e7e\u7cfb\u5fae\uff08Insyde\uff09\u516c\u53f8\u7684\u4e00\u4e2aC\u8bed\u8a00\u6e90\uff0c\u5b83\u5b9e\u73b0\u4e86\u65b0\u6280\u672f\u201cEFI/UEFI\u201d\u89c4\u8303\uff0c\u65e8\u5728\u53d6\u4ee3\u4f20\u7edf\u7684BIOS\uff08\u57fa\u672c\u8f93\u5165/\u8f93\u51fa\u7cfb\u7edf\uff09\u3002\n\nInsyde InsydeH2O\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eSWSMI\u5904\u7406\u7a0b\u5e8f\u672a\u5145\u5206\u68c0\u67e5\u6216\u9a8c\u8bc1\u5206\u914d\u7684\u7f13\u51b2\u533a\u6307\u9488\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.insyde.com/security-pledge",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-10290",
  "openTime": "2022-02-15",
  "patchDescription": "Insyde InsydeH2O\u662f\u4e2d\u56fd\u53f0\u6e7e\u7cfb\u5fae\uff08Insyde\uff09\u516c\u53f8\u7684\u4e00\u4e2aC\u8bed\u8a00\u6e90\uff0c\u5b83\u5b9e\u73b0\u4e86\u65b0\u6280\u672f\u201cEFI/UEFI\u201d\u89c4\u8303\uff0c\u65e8\u5728\u53d6\u4ee3\u4f20\u7edf\u7684BIOS\uff08\u57fa\u672c\u8f93\u5165/\u8f93\u51fa\u7cfb\u7edf\uff09\u3002\r\n\r\nInsyde InsydeH2O\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eSWSMI\u5904\u7406\u7a0b\u5e8f\u672a\u5145\u5206\u68c0\u67e5\u6216\u9a8c\u8bc1\u5206\u914d\u7684\u7f13\u51b2\u533a\u6307\u9488\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Insyde InsydeH2O\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2022-10290\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Insyde InsydeH2O 5.1\uff0c\u003c05.16.25",
      "Insyde InsydeH2O 5.2\uff0c\u003c05.26.25",
      "Insyde InsydeH2O 5.3\uff0c\u003c05.35.25",
      "Insyde InsydeH2O 5.4\uff0c\u003c05.43.25",
      "Insyde InsydeH2O 5.5\uff0c\u003c05.51.25"
    ]
  },
  "referenceLink": "https://www.insyde.com/security-pledge",
  "serverity": "\u9ad8",
  "submitTime": "2022-01-07",
  "title": "Insyde InsydeH2O\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2022-10290\uff09"
}

FKIE_CVE-2021-45970

Vulnerability from fkie_nvd - Published: 2022-01-05 23:15 - Updated: 2026-08-11 13:17

Severity

8.2 (High) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

URL	Tags
cve@mitre.org	https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf	Third Party Advisory
cve@mitre.org	https://security.netapp.com/advisory/ntap-20220216-0004/	Third Party Advisory
cve@mitre.org	https://www.insyde.com/security-pledge	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.netapp.com/advisory/ntap-20220216-0004/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.insyde.com/security-pledge	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.kb.cert.org/vuls/id/796611
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	https://cert-portal.siemens.com/productcert/html/ssa-306654.html

Impacted products

Vendor	Product	Version
insyde	insydeh2o	*
insyde	insydeh2o	*
insyde	insydeh2o	*
insyde	insydeh2o	*
insyde	insydeh2o	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    },
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "RUGGEDCOM APE1808 - BIOS",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V1.0.202N",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC Field PG M5",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V22.01.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC Field PG M6",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V26.01.13",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC127E",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V27.01.09",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC227G",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V28.01.04",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC277G",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V28.01.04",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC\u00a0IPC277G PRO",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V28.01.04",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC327G",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V28.01.04",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC377G",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V28.01.04",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC427E",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V21.01.17",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC477E",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V21.01.17",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC477E PRO",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V21.01.17",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC627E",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V25.02.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC647E",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V25.02.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC677E",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V25.02.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC847E",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V25.02.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC ITP1000",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V23.01.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIPLUS IPC427E",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V21.01.17",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6D01558-E38E-4A46-94A7-6F43BECA2599",
              "versionEndExcluding": "5.16.25",
              "versionStartIncluding": "5.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E8E5C28-ACA1-46AC-B0C0-958B7805F75A",
              "versionEndExcluding": "5.26.25",
              "versionStartIncluding": "5.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AA45E92-34FA-4583-938D-2139F870034F",
              "versionEndExcluding": "5.35.25",
              "versionStartIncluding": "5.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "81782BA4-3BE8-4C12-BBA1-584C7EF98358",
              "versionEndExcluding": "5.43.25",
              "versionStartIncluding": "5.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6EC229D4-4C67-4B44-ACEE-48DB31C87C4C",
              "versionEndExcluding": "05.51.25",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location)."
    },
    {
      "lang": "es",
      "value": "Se ha detectado un problema en IdeBusDxe en InsydeH2O con el kernel 5.1 anteriores a 05.16.25, 5.2 anteriores a 05.26.25, 5.3 anteriores a 05.35.25, 5.4 anteriores a 05.43.25 y 5.5 anteriores a 05.51.25. Se presenta una vulnerabilidad en la rama SMM (System Management Mode) que registra un manejador SWSMI que no comprueba ni valida suficientemente el puntero del buffer asignado (el c\u00f3digo de estado guardado en la ubicaci\u00f3n CommBuffer+4)."
    }
  ],
  "id": "CVE-2021-45970",
  "lastModified": "2026-08-11T13:17:22.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-01-05T23:15:08.887",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220216-0004/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.insyde.com/security-pledge"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220216-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.insyde.com/security-pledge"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.kb.cert.org/vuls/id/796611"
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-306654.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-3P59-3FGJ-3HG8

Vulnerability from github – Published: 2022-02-10 00:01 – Updated: 2026-08-11 15:30

Details

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-45970"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-120",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-05T23:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location).",
  "id": "GHSA-3p59-3fgj-3hg8",
  "modified": "2026-08-11T15:30:30Z",
  "published": "2022-02-10T00:01:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45970"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-306654.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220216-0004"
    },
    {
      "type": "WEB",
      "url": "https://www.insyde.com/security-pledge"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/796611"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2021-45970

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-45970

Aliases

CVE-2021-45970

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-45970",
    "description": "An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location).",
    "id": "GSD-2021-45970"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-45970"
      ],
      "details": "An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location).",
      "id": "GSD-2021-45970",
      "modified": "2023-12-13T01:23:19.665935Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2021-45970",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location)."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.insyde.com/security-pledge",
            "refsource": "MISC",
            "url": "https://www.insyde.com/security-pledge"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20220216-0004/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20220216-0004/"
          },
          {
            "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf",
            "refsource": "CONFIRM",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.16.25",
                "versionStartIncluding": "5.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.26.25",
                "versionStartIncluding": "5.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.35.25",
                "versionStartIncluding": "5.3",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.43.25",
                "versionStartIncluding": "5.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "05.51.25",
                "versionStartIncluding": "5.5",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-45970"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-787"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.insyde.com/security-pledge",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.insyde.com/security-pledge"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220216-0004/",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.netapp.com/advisory/ntap-20220216-0004/"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.5,
          "impactScore": 6.0
        }
      },
      "lastModifiedDate": "2022-03-29T16:35Z",
      "publishedDate": "2022-01-05T23:15Z"
    }
  }
}

SSA-306654

Vulnerability from csaf_siemens - Published: 2022-02-22 00:00 - Updated: 2026-08-11 00:00

Summary

SSA-306654: Insyde BIOS Vulnerabilities in Siemens Industrial Products

Scope

26 vulnerabilities in this advisory, including CVE-2021-45970.

CVE-2021-45970

8.4 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known affected: 18 products

https://support.industry.siemens.com/cs/ww/en/view/109814796/ https://support.industry.siemens.com/cs/ww/en/view/109763408/

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-45970 (GCVE-0-2021-45970)

BDU:2022-01018 (CVE-2021-45970)

CERTFR-2022-AVI-180

Solution

CNVD-2022-10290

FKIE_CVE-2021-45970

GHSA-3P59-3FGJ-3HG8

GSD-2021-45970

SSA-306654

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour