CVE-2023-52548

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Huawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26) Arbitrary Memory Corruption in SMI Handler of ThisiServicesSmm SMM module. This can be leveraged by a malicious OS attacker to corrupt arbitrary SMRAM memory and, in turn, lead to code execution in SMM

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-787

Affected software

Vendor	Product	Versions
Huawei	CurieM-WFG9B	OTA-CurieM-B-BIOS-2.28
huawei	curiem-wfg9b	>= 2.28, < 2.32

References

Timeline

Published: May 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-525497.5Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service con CVE-2023-52557.5For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.CVE-2023-525507.5Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service con CVE-2023-525515.3Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service con CVE-2023-525527.5Input verification vulnerability in the power module. Impact: Successful exploitation of this vulnerability will affect availability.CVE-2023-525537.4Race condition vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability will affect availability.CVE-2023-525546.5Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect service confident CVE-2023-525556.1In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.CVE-2023-525566.2In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel CVE-2023-525577.5In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.CVE-2023-525587.5In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash CVE-2023-525595.5In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid memory allocation in iommu_suspend() The iommu_suspe