CVE-2021-33626

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.

Link	Resource
https://www.insyde.com/security-pledge/SA-2021001	Vendor Advisory
https://www.insyde.com/security-pledge	Vendor Advisory
https://security.netapp.com/advisory/ntap-20220216-0006/	Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf	Third Party Advisory

Configuration 1

cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:* cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:* cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:* cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:* cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:* cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:* cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*

---

Published : 2021-10-01 03:15

Updated : 2022-04-24 02:03

---

NVD link : CVE-2021-33626

Mitre link : CVE-2021-33626

Siemens

Simatic Field Pg M5 Firmware

CWE-829