CVE-2021-43323

HighCVSS 8.2/10Last modified Aug 11, 2026

Description

An issue was discovered in UsbCoreDxe in Insyde InsydeH2O with kernel 5.5 before 05.51.45, 5.4 before 05.43.45, 5.3 before 05.35.45, 5.2 before 05.26.45, 5.1 before 05.16.45, and 5.0 before 05.08.45. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2022
Last modified: Aug 11, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-433246.1LibreNMS through 21.10.2 allows XSS via a widget title.CVE-2021-433257.8Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regre CVE-2021-433267.8Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.CVE-2021-433274.6An issue was discovered on Renesas RX65 and RX65N devices. With a VCC glitch, an attacker can extract the security ID key from the device. T CVE-2021-433299.8A SQL injection vulnerability in license_update.php in Mumara Classic through 2.93 allows a remote unauthenticated attacker to execute arbit CVE-2021-43336.5The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to CVE-2021-433316.1In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.CVE-2021-433326.5In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. T CVE-2021-433336.5The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of confi CVE-2021-433345.4BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.CVE-2021-433367.8An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK before 2022.11. The speci CVE-2021-433376.5SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env opt