CVE-2022-36448

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the PnpSmm driver.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://binarly.io/advisories/BRLY-2022-023/index.htmlExploit, Third Party Advisory
https://www.insyde.com/security-pledgeVendor Advisory
https://www.insyde.com/security-pledge/SA-2022032Vendor Advisory
https://binarly.io/advisories/BRLY-2022-023/index.htmlExploit, Third Party Advisory
https://www.insyde.com/security-pledgeVendor Advisory
https://www.insyde.com/security-pledge/SA-2022032Vendor Advisory

Timeline

Published: Sep 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-364496.5An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access CVE-2022-364509.8Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checki CVE-2022-364518.8A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct CVE-2022-364529.8A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload mali CVE-2022-364538.8A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their p CVE-2022-364546.5A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile CVE-2022-364557.8TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.c CVE-2022-364567.8TOTOLink A720R V4.1.5cu.532_B20210610 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi CVE-2022-364587.8TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the command parameter in the function CVE-2022-364597.8TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the host_time parameter in the functi CVE-2022-36464.3A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_write CVE-2022-364607.8TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the FileName parameter in the functio