Technical impact
Improper privilege management in the KVM key download component permits an attacker to swap tokens and retrieve sensitive encryption keys, enabling unauthorized access to privileged resources and compromising confidentiality. The weakness is a classic privilege escalation flaw, identified by CWE-269, where the boundary between trusted and untrusted code is insufficiently enforced.
Affected Systems
Affected broad range of AMD processors and related management portals, including Athlon 3000 series, Ryzen 3000‑9000 series, Threadripper series, and the AMD Device Management Portal. All variants listed as affected by the vendor include both desktop and mobile processors with Radeon graphics, as well as advanced AI and Threadripper professional lines.
Risk and Exploitability
The CVSS score of 6.0 indicates a moderate severity condition, while an EPSS score is unavailable and the issue is not listed in the CISA KEV catalog. Exploitation is likely to require local or privileged access to the KVM host, as the flaw involves token manipulation within the KVM key download service. If an attacker can execute code on the host or on a trusted guest, they can swap tokens and download keys, potentially escalating privileges and extracting confidential data. The lack of publicly available exploit data suggests that exploitation complexity is moderate but feasible for knowledgeable adversaries.
