CVE-2021-33626: Insyde INSYDEH2O

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.

Affected products

• Insyde INSYDEH2O: from 5.3, before 5.34.44 (fixed in 5.34.44); from 5.2, before 5.25.44 (fixed in 5.25.44); from 5.1, before 5.16.25 (fixed in 5.16.25); from 5.4, before 5.42.44 (fixed in 5.42.44); from 5.3, before 5.35.25 (fixed in 5.35.25); from 5.2, before 5.26.25 (fixed in 5.26.25); …
• Siemens Ruggedcom APR1808 Firmware: affected versions not specified
• Siemens SIMATIC Field Pg m5 Firmware: affected versions not specified
• Siemens SIMATIC Field Pg m6 Firmware: affected versions not specified
• Siemens SIMATIC IPC127E Firmware: affected versions not specified
• Siemens SIMATIC IPC227G Firmware: affected versions not specified
• Siemens SIMATIC IPC277G Firmware: affected versions not specified
• Siemens SIMATIC IPC327G Firmware: affected versions not specified
• Siemens SIMATIC IPC377G Firmware: affected versions not specified
• Siemens SIMATIC IPC427E Firmware: affected versions not specified
• Siemens SIMATIC IPC477E Firmware: affected versions not specified
• Siemens SIMATIC IPC477E Pro Firmware: affected versions not specified
• Siemens SIMATIC IPC627E Firmware: affected versions not specified
• Siemens SIMATIC IPC647E Firmware: affected versions not specified
• Siemens SIMATIC IPC677E Firmware: affected versions not specified
• Siemens SIMATIC IPC847E Firmware: affected versions not specified
• Siemens SIMATIC ITP1000 Firmware: affected versions not specified

Published 2021-10-01. Last modified 2026-08-11.