CVE-2021-43522: Insyde INSYDEH2O

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 2021-11-08, 5.2 through 2021-11-08, and 5.3 through 2021-11-08. A StorageSecurityCommandDxe SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Affected products

• Insyde INSYDEH2O: from 5.1, before 5.14.34 (fixed in 5.14.34); from 5.2, before 5.24.34 (fixed in 5.24.34); from 5.3, before 5.33.34 (fixed in 5.33.34)

Published 2022-02-03. Last modified 2026-08-11.