HP BIOS firmware 安全漏洞

HP BIOS firmware is a printer BIOS firmware from Hewlett-Packard HP in the United States. A security vulnerability exists in HP BIOS firmware that originates from arbitrary code execution, denial of service, and information disclosure...

CVE-2022-38787

Improper input validation in firmware for some IntelR FPGA products before version 2.7.0 Hotfix may allow an authenticated user to potentially enable escalation of privilege via local access...

MSI Data Breach: Private Code Signing Keys Leaked on the Dark Web

The threat actors behind the ransomware attack on Taiwanese PC maker MSI last month have leaked the company's private code signing keys on their dark website. "Confirmed, Intel OEM private key leaked, causing an impact on the entire ecosystem," Alex Matrosov, founder and CEO of firmware security...

Google Teams Up with Ecosystem Partners to Enhance Security of SoC Processors

Google said it's working with ecosystem partners to harden the security of firmware that interacts with Android. While the Android operating system runs on what's called the application processor AP, it's just one of the many processors of a system-on-chip SoC that cater to various tasks like...

Google Teams Up with Ecosystem Partners to Enhance Security of SoC Processors

Google said it's working with ecosystem partners to harden the security of firmware that interacts with Android. While the Android operating system runs on what's called the application processor AP, it's just one of the many processors of a system-on-chip SoC that cater to various tasks like...

CVE-2023-24236

TOTOlink A7100RUV7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules...

CVE-2020-23588

CVE-2020-23588 affects OPTILINK OP-XT71000N hardware (Version V2.2) with firmware OP_V3.3.1-191028. An unauthenticated, remote attacker can perform a CSRF attack via /rmtacc.asp to enable/disable ports and to change port numbers. Impact: unauthorized configuration changes. The Red Hat advisory an...

Insyde InsydeH2O 缓冲区错误漏洞

Insyde InsydeH2O is a C source from Insyde Corporation of Taiwan, which implements the new technology "EFI/UEFI" specification designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O PcdSmmDxe, which arises from the vulnerability of...

CVE-2022-34152

Improper input validation in BIOS firmware for some IntelR NUC Boards, IntelR NUC Kits before version TY0070 may allow a privileged user to potentially enable escalation of privilege via local access...

Multiple race conditions due to TOCTOU flaws in various UEFI Implementations

Overview Multiple Unified Extensible Firmware Interface UEFI implementations are vulnerable to code execution in System Management Mode SMM by an attacker who gains administrative privileges on the local machine. An attacker can corrupt the memory using Direct Memory Access DMA timing attacks tha...

Intel(R) SSD DC 授权问题漏洞

IntelR SSD DC is an internal solid state drive from Intel Corporation USA. A security vulnerability exists in IntelR SSD DC Products that stems from improper authentication in its firmware that could allow an unauthenticated user to potentially escalate privileges through physical access...

PT-2022-25305 · American Megatrends · Ami Aptiov

Name of the Vulnerable Software and Affected Versions: AMI Aptio version 5.x Description: An attacker can exploit this issue to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than the operating system OS and completely...

Input validation

Improper initialization in the firmware for some IntelR NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable an escalation of privilege via local access...

Hardcoded credentials

Totolink A3600RFirmware V4.1.2cu.5182B20201102 contains a hard code password for root in /etc/shadow.sample...

CVE-2022-31206

The Omron SYSMAC Nx product family PLCs NJ series, NY series, NX series, and PMAC series through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software which compiles IEC 61131-3 conformant POU code to native machine code for execution...

CVE-2021-40597

The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password...

Critical 'Pantsdown' BMC Vulnerability Affects QCT Servers Used in Data Centers

Quanta Cloud Technology QCT servers have been identified as vulnerable to the severe "Pantsdown" Baseboard Management Controller BMC flaw, according to new research published today. "An attacker running code on a vulnerable QCT server would be able to 'hop' from the server host to the BMC and mov...

Input validation

Improper input validation in firmware for some IntelR NUCs may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2021-39298

A potential vulnerability in AMD System Management Mode SMM interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware...

coreboot 安全漏洞

coreboot is a freeware program. It is designed to replace the proprietary BIOS firmware found in most computers. A security vulnerability exists in coreboot 4.13 through 4.16, which originates on the AP and may occur as a result of arbitrary code execution in the SMM...