CVE-2020-5953: Insyde INSYDEH2O

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).

Affected products

• Insyde INSYDEH2O: version 5.12.09.0074 only; version 5.23.04.0045 only; version 5.23.45.0023 only; version 5.33.15.0034 only; version 5.34.03.0029 only; version 5.42.03.0010 only
• Siemens Ruggedcom APE1808 Firmware: affected versions not specified
• Siemens SIMATIC Field Pg m5 Firmware: affected versions not specified
• Siemens SIMATIC Field Pg m6 Firmware: affected versions not specified
• Siemens SIMATIC IPC127E Firmware: affected versions not specified
• Siemens SIMATIC IPC227G Firmware: affected versions not specified
• Siemens SIMATIC IPC277G Firmware: affected versions not specified
• Siemens SIMATIC IPC327G Firmware: affected versions not specified
• Siemens SIMATIC IPC377G Firmware: affected versions not specified
• Siemens SIMATIC IPC427E Firmware: affected versions not specified
• Siemens SIMATIC IPC477E Firmware: affected versions not specified
• Siemens SIMATIC IPC477E Pro Firmware: affected versions not specified
• Siemens SIMATIC IPC627E Firmware: affected versions not specified
• Siemens SIMATIC IPC647E Firmware: affected versions not specified
• Siemens SIMATIC IPC677E Firmware: affected versions not specified
• Siemens SIMATIC IPC847E Firmware: affected versions not specified
• Siemens SIMATIC ITP1000 Firmware: affected versions not specified

Published 2022-02-03. Last modified 2026-08-11.