CVEvulnerability

CVE-2019-12532

7.8 HIGH Published 2019-08-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-08-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P

Description

Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08.

Affected configurations

• insyde h2oelv (< 100.00.02.08) • insyde h2offt (>= 3.02 <= 5.28) • insyde h2offt (>= 100.00.00.00 <= 100.00.08.23) • insyde h2offt (>= 200.00.00.01 <= 200.00.00.05) • insyde h2ooae (< 200.00.00.02) • insyde h2opcm (< 100.00.06.00) • insyde h2osde (< 200.00.00.07) • insyde h2ouve (< 200.00.02.02)

References