CVE-2021-33625

An issue was discovered in Kernel 5.x (starting from 5.1) in Insyde InsydeH2O, has a SMM memory...

7.5 High

An issue was discovered in Kernel 5.x in Insyde InsydeH2O, affecting HddPassword. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.32%Unchanged since Feb 3, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2021-33625
CVSS 3.1: 7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-33625
Updated: 2026-11-02

EUVDEUVD-2021-20302 No score

Record: EUVD-2021-20302
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mxqq-8hhr-mqww 7.5

An issue was discovered in Kernel 5.x (starting from 5.1) in Insyde InsydeH2O, has a SMM memory...

An issue was discovered in Kernel 5.x (starting from 5.1) in Insyde InsydeH2O, has a SMM memory corruption vulnerability allowing a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Record: GHSA-mxqq-8hhr-mqww
CVSS 3.1: 7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-02

Affected products

Show 24 moreShow less

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-33625 is a high vulnerability (CVSS 7.5) in Insyde Insydeh2o, published February 3, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. No source names a fixed version.