CVE-2021-43615 json
An issue was discovered in HddPassword in Insyde InsydeH2O with kernel 5.1 before 05.16.23, 5.2 before 05.26.23, 5.3 before 05.35.23, 5.4 b…
published 2022-02-03 4 y ago modified 2026-08-11 2 mo ago also EUVD-2021-30529
- cvss
- 8.2
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
An issue was discovered in HddPassword in Insyde InsydeH2O with kernel 5.1 before 05.16.23, 5.2 before 05.26.23, 5.3 before 05.35.23, 5.4 before 05.43.22, and 5.5 before 05.51.22. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
Patch / fix
- Siemens RUGGEDCOM APE1808 - BIOS V1.0.202N
- Siemens SIMATIC Field PG M5 V22.01.10
- Siemens SIMATIC Field PG M6 V26.01.13
- Siemens SIMATIC IPC127E V27.01.09
- Siemens SIMATIC IPC227G V28.01.04
- Siemens SIMATIC IPC277G V28.01.04
- Siemens SIMATIC IPC277G PRO V28.01.04
- Siemens SIMATIC IPC327G V28.01.04
- Siemens SIMATIC IPC377G V28.01.04
- Siemens SIMATIC IPC427E V21.01.17
- Siemens SIMATIC IPC477E V21.01.17
- Siemens SIMATIC IPC477E PRO V21.01.17
- Siemens SIMATIC IPC627E V25.02.12
- Siemens SIMATIC IPC647E V25.02.12
- Siemens SIMATIC IPC677E V25.02.12
- Siemens SIMATIC IPC847E V25.02.12
- Siemens SIMATIC ITP1000 V23.01.10
- Siemens SIPLUS IPC427E V21.01.17
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.2 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Siemens RUGGEDCOM APE1808 - BIOS
- Siemens SIMATIC Field PG M5
- Siemens SIMATIC Field PG M6
- Siemens SIMATIC IPC127E
- Siemens SIMATIC IPC227G
- Siemens SIMATIC IPC277G
- Siemens SIMATIC IPC277G PRO
- Siemens SIMATIC IPC327G
- Siemens SIMATIC IPC377G
- Siemens SIMATIC IPC427E
- Siemens SIMATIC IPC477E
- Siemens SIMATIC IPC477E PRO
- Siemens SIMATIC IPC627E
- Siemens SIMATIC IPC647E
- Siemens SIMATIC IPC677E
- Siemens SIMATIC IPC847E
- Siemens SIMATIC ITP1000
- Siemens SIPLUS IPC427E
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
insyde.com
/security-pledge
vendor-advisory
-
insyde.com
/security-pledge/SA-2022013
vendor-advisory
-
security.netapp.com
/advisory/ntap-20220216-0010/
third-party-advisory
-
cert-portal.siemens.com
/productcert/pdf/ssa-306654.pdf
third-party-advisory
- kb.cert.org /vuls/id/796611
- cert-portal.siemens.com /productcert/html/ssa-306654.html
Sources
- CVE List CVE-2021-43615
- NVD CVE-2021-43615
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.