CVE-2023-20587

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flash potentially leading to arbitrary code execution.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Feb 13, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-205885.5A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.CVE-2023-205896.8An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resu CVE-2023-20595.3A vulnerability was found in DedeCMS 5.7.87. It has been rated as problematic. Affected by this issue is some unknown functionality of the f CVE-2023-2059110.0Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker to CVE-2023-205926.5Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache l CVE-2023-205935.5An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information CVE-2023-205944.4Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.CVE-2023-205969.8Improper input validation in the SMM Supervisor may allow an attacker with a compromised SMI handler to gain Ring0 access potentially leadin CVE-2023-205975.5Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.CVE-2023-205987.8An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/CVE-2023-205997.9Improper register access control in ASP may allow a privileged attacker to perform unauthorized access to ASP’s Crypto Co-Processor (CCP) re CVE-2023-20607.5Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91