AMD’s optional tools – Management Console, Ryzen Master and µProf – use unsecured HTTP transport internally. An attacker who can intercept this traffic may perform a man‑in‑the‑middle attack, redirecting or tampering with the data stream and potentially injecting malicious commands that lead to arbitrary code execution on the infected system. The vulnerability directly stems from improper handling of insecure transport, as identified by CWE‑1428, and carries the potential to compromise confidentiality, integrity, and availability by allowing malicious code to execute with local privileges.

The affected products are AMD Management Console, AMD Ryzen Master, and AMD µProf. No specific version ranges are provided; any installation of these optional tools prior to the release of the vendor’s security update may be vulnerable.

The CVSS score of 7.7 indicates high severity, although no EPSS score is available to gauge current exploitation likelihood. The vulnerability is not listed in CISA KEV, suggesting it is not widely exploited yet. The exploit requires a network attacker capable of performing a MITM attack between the AMD tool and its backend. If successful, the attacker gains the ability to execute arbitrary code on the client machine. The risk remains significant until the vendor’s patch is applied.