CVE-2023-28468

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.insyde.com/security-pledgeNot Applicable
https://www.insyde.com/security-pledge/SA-2023039Vendor Advisory
https://www.insyde.com/security-pledgeNot Applicable
https://www.insyde.com/security-pledge/SA-2023039Vendor Advisory

Timeline

Published: Aug 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-284695.5An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access CVE-2023-28477.8During internal security analysis, a local privilege escalation vulnerability has been identified. On a machine with the affected ESET produ CVE-2023-284705.3In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication.CVE-2023-284715.4Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.CVE-2023-284725.3Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for c CVE-2023-284733.3Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs secti CVE-2023-284745.4Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.CVE-2023-284756.1Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply fo CVE-2023-284765.4Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.CVE-2023-284775.4Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the CVE-2023-284788.8TP-Link EC-70 devices through 2.3.4 Build 20220902 rel.69498 have a Buffer Overflow.CVE-2023-284798.8An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform installs a full development toolchain within every TigerGrap