Technical impact
The vulnerability involves missing authentication protection on the KVM key download endpoint. This flaw permits any user who has the URL to access and download encryption keys, potentially exposing confidential data. Because the flaw is an authentication bypass (CWE-306), the primary impact is confidentiality loss and could allow attackers to compromise data encrypted by those keys.
Affected Systems
Affected systems include AMD Athlon 3000 Series Mobile Processors, AMD Device Management Portal (ADMP), AMD Ryzen 3000, 4000, 5000, 6000, 7000, 8000, 9000, 9000HX, AI 300 and AI Max 300, Threadripper 3000/3000WX, 5000WX/7000WX/9000WX series, and listed Ryzen 7030, 7035, 7040, 7045, 8040, 9000HX, AI 300 series, and Threadripper series. The flaw affects any hardware running the advertised KVM key download service and does not tie to specific firmware revisions in the provided data.
Risk and Exploitability
The CVSS score of 6.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting that it is not currently widely exploited. However, the flaw can be abused by attackers who discover or guess the specific URL, meaning that any exposed KVM host could be coerced into leaking sensitive key material. Network segregation and strict authentication are therefore warranted to mitigate this risk.
