CVE-2023-39284: Insyde INSYDEH2O

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler.

Affected products

• Insyde INSYDEH2O: from 5.2, before 5.2.05.28.33 (fixed in 5.2.05.28.33); from 5.3, before 5.3.05.37.33 (fixed in 5.3.05.37.33); from 5.4, before 5.4.05.45.33 (fixed in 5.4.05.45.33); from 5.5, before 5.5.05.53.33 (fixed in 5.5.05.53.33); from 5.6, before 5.6.05.60.33 (fixed in 5.6.05.60.33)

Published 2023-11-02. Last modified 2026-06-17.