CVE-2025-4424
SetupAutomationSmm : Arbitrary calls to SmmSetVariable with unsanitised arguments in SMI handler
- State
- Published
- Severity
- 6.0 Medium
- Published
- Jul 30, 2025
- Updated
- Aug 14, 2025
- Reserved
- May 8, 2025
Description
The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/product_security/home
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.0 Medium | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N | Insyde |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
InsydeH2OInsyde Software |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.