SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

Summary

CVE	CVE-2021-43613
State	PUBLISHED
Assigner	Insyde
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-09-03 13:04:12 UTC
Updated	2026-09-03 18:09:03 UTC
Description	An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

Risk And Classification

Primary CVSS: v3.1 6.5 MEDIUM from 8338d8cb-57f7-4252-abc0-96fd13e98d21

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

EPSS: 0.001140000 probability, percentile 0.016060000 (date 2026-09-07)

Problem Types: CWE-732 | CWE-732 CWE-732: Incorrect Permission Assignment for Critical Resource

Version	Source	Type	Score	Severity	Vector
3.1	8338d8cb-57f7-4252-abc0-96fd13e98d21	Secondary	6.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N`
3.1	CNA	CVSS	6.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N`

CVSS v3.1 Breakdown

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Insyde Software	InsydeH2O	affected See in the Solution	x86

References

Reference	Source	Link	Tags
www.insyde.com/security-pledge/sa-2022027	8338d8cb-57f7-4252-abc0-96fd13e98d21	www.insyde.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Additional Advisory Data

Solutions

CNA: Kernel 5.1: Version 05.17.09 Kernel 5.2: Version 05.27.09 Kernel 5.3: Version 05.36.09 Kernel 5.4: Version 05.44.09 Kernel 5.5: Version 05.52.09

Legacy QID Mappings

590981 Siemens Industrial Products Insyde BIOS Multiple Vulnerabilities (SSA-306654)