CVE-2022-24030

HighCVSS 7.5/10Last modified Aug 11, 2026

Description

An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	RUGGEDCOM APE1808 - BIOS	< V1.0.202N
Siemens	SIMATIC Field PG M5	< V22.01.10
Siemens	SIMATIC Field PG M6	< V26.01.13
Siemens	SIMATIC IPC127E	< V27.01.09
Siemens	SIMATIC IPC227G	< V28.01.04
Siemens	SIMATIC IPC277G	< V28.01.04
Siemens	SIMATIC IPC277G PRO	< V28.01.04
Siemens	SIMATIC IPC327G	< V28.01.04
Siemens	SIMATIC IPC377G	< V28.01.04
Siemens	SIMATIC IPC427E	< V21.01.17
Siemens	SIMATIC IPC477E	< V21.01.17
Siemens	SIMATIC IPC477E PRO	< V21.01.17
Siemens	SIMATIC IPC627E	< V25.02.12
Siemens	SIMATIC IPC647E	< V25.02.12
Siemens	SIMATIC IPC677E	< V25.02.12
Siemens	SIMATIC IPC847E	< V25.02.12
Siemens	SIMATIC ITP1000	< V23.01.10
Siemens	SIPLUS IPC427E	< V21.01.17

References

https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdfThird Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0011/Third Party Advisory
https://www.insyde.com/security-pledgeVendor Advisory
https://www.insyde.com/security-pledge/SA-2022011Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdfThird Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0011/Third Party Advisory
https://www.insyde.com/security-pledgeVendor Advisory
https://www.insyde.com/security-pledge/SA-2022011Vendor Advisory
https://www.kb.cert.org/vuls/id/796611
https://cert-portal.siemens.com/productcert/html/ssa-306654.html

Timeline

Published: Feb 3, 2022
Last modified: Aug 11, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-240318.2An issue was discovered in NvmExpressDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an a CVE-2022-240325.3Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames on the platform bec CVE-2022-240357.5An issue was discovered in ONOS 2.5.1. The purge-requested intent remains on the list, but it does not respond to changes in topology (e.g.,CVE-2022-240368.6Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificat CVE-2022-240378.2Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain CVE-2022-240386.5Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage t CVE-2022-240399.0A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). T CVE-2022-24046.1The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading t CVE-2022-240406.5A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PX CVE-2022-240416.5A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PX CVE-2022-240429.1A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PX CVE-2022-240435.3A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PX