What is CVE-2023-52080?

CVE-2023-52080 is a high-severity vulnerability in N/a, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 7.7/10. Published 2024-04-29.

How severe is CVE-2023-52080?

High severity. CVSS v3 base score is 7.7 out of 10.

Buffer overflow in N/a

CVE-2023-52080

IEIT NF5280M6 UEFI firmware through 8.4 has a pool overflow vulnerability, caused by improper use of the gRT->GetVariable() function. Attackers with access to local NVRAM variables can exploit this by modifying these variables on SPI Flash, resulting in memory data being tampered with. When critical data in memory data is tampered with,a crash may occur.

Vulnerability class: Buffer Overflow

EPSS: 0.002 (9.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.

Affected products

N/a — versions n/a

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

References

Frequently asked questions

What is CVE-2023-52080?: CVE-2023-52080 is a high-severity vulnerability in N/a, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 7.7/10. Published 2024-04-29.
How severe is CVE-2023-52080?: High severity. CVSS v3 base score is 7.7 out of 10.