CVE-2023-25546

LowCVSS 2.5/10Last modified Jun 17, 2026

Description

Out-of-bounds read in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access.

Metrics

CVSS 3.1 2.5/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
n/aUEFI firmware for some Intel(R) ProcessorsSee references

References

Timeline

Published
Sep 16, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-255478.8A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker CVE-2023-255486.5A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being prCVE-2023-255499.8A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code execution when using a CVE-2023-25554.3The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missingCVE-2023-255509.8A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execution via the “hostnameCVE-2023-255516.1A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE file upload endCVE-2023-255528.1A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or pCVE-2023-255536.1A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE endpoint througCVE-2023-255547.8A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a locaCVE-2023-255558.1A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow aCVE-2023-255568.8A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is CVE-2023-255579.1DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backen
CVE-2023-25546: Low severity, CVSS 2.5 | Vulnix