The vulnerability is located in the AMI AptioV BIOS firmware, where local abuse of sensitive information exposure can occur. A local attacker may gain access to stored keystrokes or other sensitive data, leading to information disclosure. The impact can extend to privilege escalation and threat to confidentiality, integrity, and availability, as described in the advisory. This weakness is classified as CWE‑213, i.e. Exposure of Sensitive Information.

Vendors impacted are AMI with its AptioV BIOS firmware. Specific affected versions are not enumerated in the advisory; users should verify against the AMI security bulletin for applicable firmware releases.

The CVSS score of 5.8 indicates moderate risk, and the EPSS score is not available, meaning we lack current exploit likelihood data. The vulnerability is not listed in CISA’s KEV catalog. Because the vulnerability requires local access to the BIOS, it is likely exploitable only by attackers with physical or local console privileges or who have already compromised the machine. As such, the risk to an unprivileged user is low, but for systems with local access controls weak, the potential for privilege escalation exists. Routine monitoring and enforcement of local access controls can reduce the exposure until the firmware can be updated.