Skip to content
Fencer Vulns
medium 5.5

CVE-2021-26343 json

Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive mem…

published 2023-01-10 3 y ago modified 2026-06-17 4 mo ago also EUVD-2021-13149

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure.

Patch / fix

  • amd epyc_7003_firmware milanpi_1.0.0.3
  • amd epyc_72f3_firmware milanpi_1.0.0.3
  • amd epyc_7313_firmware milanpi_1.0.0.3
  • amd epyc_7313p_firmware milanpi_1.0.0.3
  • amd epyc_7343_firmware milanpi_1.0.0.3
  • amd epyc_7373x_firmware milanpi_1.0.0.3
  • amd epyc_73f3_firmware milanpi_1.0.0.3
  • amd epyc_7413_firmware milanpi_1.0.0.3
  • amd epyc_7443_firmware milanpi_1.0.0.3
  • amd epyc_7443p_firmware milanpi_1.0.0.3
  • amd epyc_7453_firmware milanpi_1.0.0.3
  • amd epyc_74f3_firmware milanpi_1.0.0.3
  • amd epyc_7513_firmware milanpi_1.0.0.3
  • amd epyc_7543_firmware milanpi_1.0.0.3
  • amd epyc_7543p_firmware milanpi_1.0.0.3
  • amd epyc_7573x_firmware milanpi_1.0.0.3
  • amd epyc_75f3_firmware milanpi_1.0.0.3
  • amd epyc_7643_firmware milanpi_1.0.0.3
  • amd epyc_7663_firmware milanpi_1.0.0.3
  • amd epyc_7713_firmware milanpi_1.0.0.3

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • AMD 3rd Gen EPYC

Classification

Weakness
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.