CVE-2023-28149

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 05.37.42, 5.4 before 05.45.39, 5.5 before 05.53.39, and 5.6 before 05.60.39 that could allow an attacker to modify UEFI variables.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L

Affected software

No affected versions have been published.

Timeline

Published: Jul 31, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-28159.8A vulnerability classified as critical was found in SourceCodester Online Jewelry Store 1.0. Affected by this vulnerability is an unknown fu CVE-2023-281509.8An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in CVE-2023-281519.8An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote CVE-2023-281529.8An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in CVE-2023-281536.4An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child can remove all restric CVE-2023-281549.8Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker wh CVE-2023-281556.1The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-proto CVE-2023-281585.4Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authentica CVE-2023-281594.3The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or CVE-2023-28166.5Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patc CVE-2023-281606.5When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking po CVE-2023-281618.8If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permis