CVE-2021-42554

HighCVSS 8.2/10Last modified Aug 11, 2026

Description

An issue was discovered in Insyde InsydeH2O with Kernel 5.0 before 05.08.42, Kernel 5.1 before 05.16.42, Kernel 5.2 before 05.26.42, Kernel 5.3 before 05.35.42, Kernel 5.4 before 05.42.51, and Kernel 5.5 before 05.50.51. An SMM memory corruption vulnerability in FvbServicesRuntimeDxe allows a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2022
Last modified: Aug 11, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-425557.5Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.CVE-2021-425565.5Rasa X before 0.42.4 allows Directory Traversal during archive extraction. In the functionality that allows a user to load a trained model a CVE-2021-425577.5In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials.CVE-2021-425586.1An issue was discovered in CALDERA 2.8.1. It contains multiple reflected, stored, and self XSS vulnerabilities that may be exploited by auth CVE-2021-425598.8An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Becaus CVE-2021-42566.1A vulnerability was found in ctrlo lenio. It has been classified as problematic. This affects an unknown part of the file views/index.tt. Th CVE-2021-425608.8An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These CVE-2021-425618.8An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" fun CVE-2021-425628.1An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read CVE-2021-425637.8There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows. This may allow an authorized lo CVE-2021-425645.4An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to prov CVE-2021-425656.1myfactory.FMS before 7.1-912 allows XSS via the UID parameter.