CVE-2021-43613: Insyde Software INSYDEH2O

Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days.

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

Affected products

• Insyde Software INSYDEH2O

Published 2026-09-03. Last modified 2026-09-03.