CVE-2021-43613

SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege PUBLISHED

Description (CNA)

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

Affected (CNA)

Vendor / product	Versions
Insyde Software / InsydeH2O	affected See in the Solution

CWE

CWE-732

References

https://www.insyde.com/security-pledge/sa-2022027/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.