CVE-2021-38489

HighCVSS 8.2/10Last modified Sep 3, 2026

Description

HDD password plaintext is stored in a UEFI variable.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-256

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Insyde SoftwareInsydeH2OSee in the Solution

References

Timeline

Published
Sep 3, 2026
Last modified
Sep 3, 2026
NVD status
Undergoing Analysis

Related CVEs from 2021

CVE-2021-38499.8An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System ManaCVE-2021-384907.5Altova MobileTogether Server before 7.3 SP1 allows XML exponential entity expansion, a different vulnerability than CVE-2021-37425.CVE-2021-384916.5Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. This vulnerability affects Firefox CVE-2021-384926.5When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and exCVE-2021-384938.8Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed evidence of memory corCVE-2021-384948.8Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and we presumeCVE-2021-384958.8Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and wCVE-2021-384968.8During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentialCVE-2021-384976.5Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to poCVE-2021-384987.5During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potCVE-2021-384998.8Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presumeCVE-2021-38509.1Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.
CVE-2021-38489: High severity, CVSS 8.2 | Vulnix