[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fG19BLMjmNVzpBYbpd-YnTkcIVeV_z5I6yPAlUYa0AEE":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":71,"kevVulnerabilities":127,"topProductsByCves":128,"seoMetadata":139,"meta":148},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":70},14799,"insyde",13,100,0,201,"2025-06-12","i",[16,21,27,33,38,41,44,48,52,55,59,62,65],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},80853,"insydeh2o",146,66,{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":26},80856,"kernel",24,29,"2025-04-15",{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":11,"last_cve_update":32},80845,"h2offt",7,2,"2023-09-08",{"id":34,"product_name":35,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},80848,"h2osde",1,"2019-08-26",{"id":39,"product_name":40,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},80849,"h2ouve",{"id":42,"product_name":43,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},80844,"h2oelv",{"id":45,"product_name":46,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":47},80851,"insydecrpkg","2023-08-03",{"id":49,"product_name":50,"version_count":11,"cve_count":36,"kev_count":11,"last_cve_update":51},80854,"insydeh2o_uefi_bios","2021-11-03",{"id":53,"product_name":54,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":32},80855,"iscflashx64.sys",{"id":56,"product_name":57,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":58},80850,"insyde_bios","2005-12-11",{"id":60,"product_name":61,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},80846,"h2ooae",{"id":63,"product_name":64,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},80847,"h2opcm",{"id":66,"product_name":67,"version_count":68,"cve_count":11,"kev_count":11,"last_cve_update":69},80852,"insydeh20",16,null,"Insyde is a technology vendor with 13 tracked products and 100 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[72,81,88,95,99,105,111,116,121,124],{"cveId":73,"description":74,"publishedDate":75,"cvssScore":76,"cvssVersion":77,"severity":78,"isKev":79,"epssScore":80},"CVE-2021-38575","NetworkPkg\u002FIScsiDxe has remotely exploitable buffer overflows.","2021-12-01",8.1,"v3.1","High",false,0.01994,{"cveId":82,"description":83,"publishedDate":84,"cvssScore":85,"cvssVersion":77,"severity":86,"isKev":79,"epssScore":87},"CVE-2023-40238","A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4\u002FRLE8 compression.","2023-12-07",5.5,"Medium",0.01843,{"cveId":89,"description":90,"publishedDate":91,"cvssScore":92,"cvssVersion":77,"severity":93,"isKev":79,"epssScore":94},"CVE-2021-41842","An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.3 before 05.35.46, 5.4 before 05.43.46, and 5.5 before 05.51.45 in Insyde InsydeH2O. Code execution can occur because the SMI handler lacks a CommBuffer check.","2022-01-06",9.8,"Critical",0.01534,{"cveId":96,"description":97,"publishedDate":51,"cvssScore":92,"cvssVersion":77,"severity":93,"isKev":79,"epssScore":98},"CVE-2020-5955","An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets. A caller may be able to escalate privileges.",0.01413,{"cveId":100,"description":101,"publishedDate":102,"cvssScore":103,"cvssVersion":77,"severity":78,"isKev":79,"epssScore":104},"CVE-2021-38578","Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.","2022-03-03",7.4,0.01019,{"cveId":106,"description":107,"publishedDate":108,"cvssScore":109,"cvssVersion":77,"severity":78,"isKev":79,"epssScore":110},"CVE-2020-5956","An issue was discovered in SdLegacySmm in Insyde InsydeH2O with kernel 5.1 before 05.15.11, 5.2 before 05.25.11, 5.3 before 05.34.11, and 5.4 before 05.42.11. The software SMI handler allows untrusted external input because it does not verify CommBuffer.","2022-01-05",7.5,0.00806,{"cveId":112,"description":113,"publishedDate":114,"cvssScore":92,"cvssVersion":77,"severity":93,"isKev":79,"epssScore":115},"CVE-2023-39281","A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase.","2023-11-01",0.00487,{"cveId":117,"description":118,"publishedDate":119,"cvssScore":109,"cvssVersion":77,"severity":78,"isKev":79,"epssScore":120},"CVE-2024-52877","An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, callback function SmmCreateVariableLockList () calls CreateVariableLockListInSmm (). In CreateVariableLockListInSmm (), it uses StrSize () to get variable name size and it could lead to a buffer over-read.","2025-05-15",0.00476,{"cveId":122,"description":123,"publishedDate":119,"cvssScore":109,"cvssVersion":77,"severity":78,"isKev":79,"epssScore":120},"CVE-2024-52878","An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, VariableServicesSetVariable () can be called by gRT_>SetVariable () or the SmmSetSensitiveVariable () or SmmInternalSetVariable () from SMM. In VariableServicesSetVariable (), it uses StrSize () to get variable name size, uses StrLen () to get variable name length and uses StrCmp () to compare strings. These actions may cause a buffer over-read.",{"cveId":125,"description":126,"publishedDate":119,"cvssScore":109,"cvssVersion":77,"severity":78,"isKev":79,"epssScore":120},"CVE-2024-52879","An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SmmUpdateVariablePropertySmi () is a SMM callback function and it uses StrCmp () to compare variable names. This action may cause a buffer over-read.",[],[129,130,131,132,133,134,135,136,137,138],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":26},{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":11,"last_cve_update":32},{"id":34,"product_name":35,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},{"id":39,"product_name":40,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},{"id":42,"product_name":43,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},{"id":45,"product_name":46,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":47},{"id":49,"product_name":50,"version_count":11,"cve_count":36,"kev_count":11,"last_cve_update":51},{"id":53,"product_name":54,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":32},{"id":56,"product_name":57,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":58},{"title":140,"metaDescription":141,"keywords":142,"structuredData":143},"Insyde - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Insyde covering 13 products with 100 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Insyde vulnerabilities, Insyde security, Insyde CVE, Insyde threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":144,"@type":145,"name":146,"description":141,"url":147},"https:\u002F\u002Fschema.org","Organization","Insyde","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Finsyde",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":149,"apiVersion":150},"2026-10-17T00:01:18.932Z","3.0"]