CVE-2020-5953

HighCVSS 7.5/10Last modified Aug 11, 2026

Description

A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected software

VendorProductVersions
n/an/an/a
SiemensSIMATIC Field PG M5< V22.01.10
SiemensSIMATIC Field PG M6< V26.01.13
SiemensSIMATIC IPC127E< V27.01.09
SiemensSIMATIC IPC227G< V28.01.04
SiemensSIMATIC IPC277G< V28.01.04
SiemensSIMATIC IPC277G PRO< V28.01.04
SiemensSIMATIC IPC327G< V28.01.04
SiemensSIMATIC IPC377G< V28.01.04
SiemensSIMATIC IPC427E< V21.01.17
SiemensSIMATIC IPC477E< V21.01.17
SiemensSIMATIC IPC477E PRO< V21.01.17
SiemensSIMATIC IPC627E< V25.02.12
SiemensSIMATIC IPC647E< V25.02.12
SiemensSIMATIC IPC677E< V25.02.12
SiemensSIMATIC IPC847E< V25.02.12
SiemensSIMATIC ITP1000< V23.01.10
SiemensSIPLUS IPC427E< V21.01.17

References

Timeline

Published
Feb 3, 2022
Last modified
Aug 11, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-59559.8An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets. A caller may be able to escalatCVE-2020-59567.5An issue was discovered in SdLegacySmm in Insyde InsydeH2O with kernel 5.1 before 05.15.11, 5.2 before 05.25.11, 5.3 before 05.34.11, and 5.CVE-2020-59577.8NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which an attacker with loCVE-2020-59587.8NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which an attacker with loCVE-2020-59595.5NVIDIA Virtual GPU Manager, all versions, contains a vulnerability in the vGPU plugin in which an input index value is incorrectly validatedCVE-2020-59605.5NVIDIA Virtual GPU Manager contains a vulnerability in the kernel module (nvidia.ko), where a null pointer dereference may occur, which may CVE-2020-59615.5NVIDIA vGPU graphics driver for guest OS contains a vulnerability in which an incorrect resource clean up on a failure path can impact the gCVE-2020-59627.8NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component, in which an attacker with lCVE-2020-59637.8NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the Inter Process Communication APIs, in which improper access CVE-2020-59647.8NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the service host component, in which the application resources CVE-2020-59655.5NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the DirectX 11 user mode driver (nvwgf2um/x.dll), in which a spCVE-2020-59667.8NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape,
CVE-2020-5953: High severity, CVSS 7.5 | Vulnix