CVE-2022-35408

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation of privileges. An attacker could overwrite the function pointers in the EFI_BOOT_SERVICES table before the USB SMI handler triggers. (This is not exploitable from code running in the operating system.)

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-123

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://binarly.io/advisories/BRLY-2022-022/index.htmlExploit, Third Party Advisory
https://www.insyde.com/security-pledgeVendor Advisory
https://www.insyde.com/security-pledge/SA-2022031Vendor Advisory
https://binarly.io/advisories/BRLY-2022-022/index.htmlExploit, Third Party Advisory
https://www.insyde.com/security-pledgeVendor Advisory
https://www.insyde.com/security-pledge/SA-2022031Vendor Advisory

Timeline

Published: Sep 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-354099.1An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an inva CVE-2022-35417.8A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file dr CVE-2022-354107.5mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primari CVE-2022-354119.8rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other wor CVE-2022-354125.1Digital Guardian Agent 7.7.4.0042 allows an administrator (who ordinarily does not have a supported way to uninstall the product) to disable CVE-2022-354139.8WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidenti CVE-2022-354148.8softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex cr CVE-2022-354157.8An improper input validation in NI System Configuration Manager before 22.5 may allow a privileged user to potentially enable escalation of CVE-2022-354166.1H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS.CVE-2022-354217.2Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the pname parameter at /admin/op CVE-2022-354229.8Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the qid parameter at update.php.CVE-2022-354269.8UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file.