[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fG19BLMjmNVzpBYbpd-YnTkcIVeV_z5I6yPAlUYa0AEE":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":71,"kevVulnerabilities":132,"topProductsByCves":133,"seoMetadata":144,"meta":153},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":70},14799,"insyde",13,100,0,201,"2025-06-12","i",[16,21,27,33,38,41,44,48,52,55,59,62,65],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},80853,"insydeh2o",146,66,{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":26},80856,"kernel",24,29,"2025-04-15",{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":11,"last_cve_update":32},80845,"h2offt",7,2,"2023-09-08",{"id":34,"product_name":35,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},80848,"h2osde",1,"2019-08-26",{"id":39,"product_name":40,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},80849,"h2ouve",{"id":42,"product_name":43,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},80844,"h2oelv",{"id":45,"product_name":46,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":47},80851,"insydecrpkg","2023-08-03",{"id":49,"product_name":50,"version_count":11,"cve_count":36,"kev_count":11,"last_cve_update":51},80854,"insydeh2o_uefi_bios","2021-11-03",{"id":53,"product_name":54,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":32},80855,"iscflashx64.sys",{"id":56,"product_name":57,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":58},80850,"insyde_bios","2005-12-11",{"id":60,"product_name":61,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},80846,"h2ooae",{"id":63,"product_name":64,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},80847,"h2opcm",{"id":66,"product_name":67,"version_count":68,"cve_count":11,"kev_count":11,"last_cve_update":69},80852,"insydeh20",16,null,"Insyde is a technology vendor with 13 tracked products and 100 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[72,81,88,95,99,105,111,116,122,127],{"cveId":73,"description":74,"publishedDate":75,"cvssScore":76,"cvssVersion":77,"severity":78,"isKev":79,"epssScore":80},"CVE-2023-40238","A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4\u002FRLE8 compression.","2023-12-07",5.5,"v3.1","Medium",false,0.01858,{"cveId":82,"description":83,"publishedDate":84,"cvssScore":85,"cvssVersion":77,"severity":86,"isKev":79,"epssScore":87},"CVE-2021-38575","NetworkPkg\u002FIScsiDxe has remotely exploitable buffer overflows.","2021-12-01",8.1,"High",0.01855,{"cveId":89,"description":90,"publishedDate":91,"cvssScore":92,"cvssVersion":77,"severity":93,"isKev":79,"epssScore":94},"CVE-2021-41842","An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.3 before 05.35.46, 5.4 before 05.43.46, and 5.5 before 05.51.45 in Insyde InsydeH2O. Code execution can occur because the SMI handler lacks a CommBuffer check.","2022-01-06",9.8,"Critical",0.01534,{"cveId":96,"description":97,"publishedDate":51,"cvssScore":92,"cvssVersion":77,"severity":93,"isKev":79,"epssScore":98},"CVE-2020-5955","An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets. A caller may be able to escalate privileges.",0.01368,{"cveId":100,"description":101,"publishedDate":102,"cvssScore":103,"cvssVersion":77,"severity":86,"isKev":79,"epssScore":104},"CVE-2021-38578","Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.","2022-03-03",7.4,0.00995,{"cveId":106,"description":107,"publishedDate":108,"cvssScore":109,"cvssVersion":77,"severity":86,"isKev":79,"epssScore":110},"CVE-2020-5956","An issue was discovered in SdLegacySmm in Insyde InsydeH2O with kernel 5.1 before 05.15.11, 5.2 before 05.25.11, 5.3 before 05.34.11, and 5.4 before 05.42.11. The software SMI handler allows untrusted external input because it does not verify CommBuffer.","2022-01-05",7.5,0.00806,{"cveId":112,"description":113,"publishedDate":114,"cvssScore":92,"cvssVersion":77,"severity":93,"isKev":79,"epssScore":115},"CVE-2023-39281","A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase.","2023-11-01",0.00487,{"cveId":117,"description":118,"publishedDate":119,"cvssScore":120,"cvssVersion":77,"severity":86,"isKev":79,"epssScore":121},"CVE-2022-36338","An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, creating SMM, leads to arbitrary code execution. An attacker can replace the pointer to the UEFI boot service GetVariable with a pointer to malware, and then generate a software SMI.","2022-09-23",8.2,0.00429,{"cveId":123,"description":124,"publishedDate":37,"cvssScore":125,"cvssVersion":77,"severity":86,"isKev":79,"epssScore":126},"CVE-2019-12532","Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08.",7.8,0.00403,{"cveId":128,"description":129,"publishedDate":130,"cvssScore":109,"cvssVersion":77,"severity":86,"isKev":79,"epssScore":131},"CVE-2024-52877","An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, callback function SmmCreateVariableLockList () calls CreateVariableLockListInSmm (). In CreateVariableLockListInSmm (), it uses StrSize () to get variable name size and it could lead to a buffer over-read.","2025-05-15",0.004,[],[134,135,136,137,138,139,140,141,142,143],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":26},{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":11,"last_cve_update":32},{"id":34,"product_name":35,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},{"id":39,"product_name":40,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},{"id":42,"product_name":43,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":37},{"id":45,"product_name":46,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":47},{"id":49,"product_name":50,"version_count":11,"cve_count":36,"kev_count":11,"last_cve_update":51},{"id":53,"product_name":54,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":32},{"id":56,"product_name":57,"version_count":36,"cve_count":36,"kev_count":11,"last_cve_update":58},{"title":145,"metaDescription":146,"keywords":147,"structuredData":148},"Insyde - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Insyde covering 13 products with 100 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Insyde vulnerabilities, Insyde security, Insyde CVE, Insyde threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":149,"@type":150,"name":151,"description":146,"url":152},"https:\u002F\u002Fschema.org","Organization","Insyde","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Finsyde",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":154,"apiVersion":155},"2026-10-28T17:50:53.216Z","3.0"]