What is CVE-2023-27471?

CVE-2023-27471 is a medium-severity vulnerability in Insyde Insydeh2o. CVSS score: 5.5/10. Published 2023-08-18.

How severe is CVE-2023-27471?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Insyde Insydeh2o

CVE-2023-27471

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. UEFI implementations do not correctly protect and validate information contained in the 'MeSetup' UEFI variable. On some systems, this variable can be overwritten using operating system APIs. Exploitation of this vulnerability could potentially lead to denial of service for the platform.

EPSS: 0.002 (6.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Insyde Insydeh2o — versions 5.0, 5.1, 5.2
N/a — versions n/a

References

cve@mitre.org (Vendor Advisory)

Frequently asked questions

What is CVE-2023-27471?: CVE-2023-27471 is a medium-severity vulnerability in Insyde Insydeh2o. CVSS score: 5.5/10. Published 2023-08-18.
How severe is CVE-2023-27471?: Medium severity. CVSS v3 base score is 5.5 out of 10.