Description
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
Published: 2026-09-03
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An issue in SysPasswordDxe of InsydeH2O exposes user and administrator password hashes in runtime UEFI variables, allowing an attacker with access to those variables to obtain credentials and elevate privileges. This flaw is an access control weakness, as identified by CWE-732.

Affected Systems

The vulnerability affects Insyde Software's InsydeH2O firmware across Kernel versions 5.1 through 5.5. Specifically, the following firmware releases contain the flaw: Kernel 5.1 version 05.17.09; Kernel 5.2 version 05.27.09; Kernel 5.3 version 05.36.09; Kernel 5.4 version 05.44.09; and Kernel 5.5 version 05.52.09.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an adversary with physical or remote firmware access who can read the exposed UEFI variables; local machine access would be sufficient to retrieve the hashes. Once obtained, these credentials enable escalation of privilege to administrative levels.

Generated by OpenCVE AI on September 3, 2026 at 09:22 UTC.

Remediation

Vendor Solution

Kernel 5.1: Version 05.17.09 Kernel 5.2: Version 05.27.09 Kernel 5.3: Version 05.36.09 Kernel 5.4: Version 05.44.09 Kernel 5.5: Version 05.52.09

OpenCVE Recommended Actions

  • Apply the latest InsydeH2O firmware update that removes password hash exposure, such as Kernel 5.5 version 05.52.09.
  • After updating, verify that runtime UEFI variables no longer contain user or administrator password hashes.
  • If a firmware update is pending, restrict UEFI variable modification permissions through the firmware configuration to prevent unintended exposure of sensitive data.

Generated by OpenCVE AI on September 3, 2026 at 09:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Insyde Software
Insyde Software insydeh2o
Vendors & Products Insyde Software
Insyde Software insydeh2o

Thu, 03 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 02:15:00 +0000

Type Values Removed Values Added
Description An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
Title SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
Weaknesses CWE-732
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N'}

Subscriptions

Insyde Software Insydeh2o
cve-icon MITRE

Status: PUBLISHED

Assigner: Insyde

Published:

Updated: 2026-09-03T13:03:26.609Z

Reserved: 2021-11-12T22:48:20.355Z

Link: CVE-2021-43613

cve-icon Vulnrichment

Updated: 2026-09-03T13:02:59.828Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-03T13:04:12.157

Modified: 2026-09-03T18:09:03.317

Link: CVE-2021-43613

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T15:33:33Z

Weaknesses
  • CWE-732

    Incorrect Permission Assignment for Critical Resource