{"id":"CVE-2026-33197","aliases":["EUVD-2026-72791","GHSA-r768-j77w-2vwm"],"status":"published","title":"BDS Module Bypass Secure Boot Advisory","description":"AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00175,"percentile":0.07105,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-184"],"published":"2026-09-08T14:02:30Z","modified":"2026-09-08T16:18:08Z","products":[{"vendor":"ami","product":"aptiov"}],"references":[{"url":"https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026001.pdf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33197"},{"url":"https://github.com/advisories/GHSA-r768-j77w-2vwm"}],"sources":{"cve":[{"id":"CVE-2026-33197","title":"BDS Module Bypass Secure Boot Advisory","description":"AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.","status":"published","published":"2026-09-08T14:02:30.089Z","modified":"2026-09-08T15:22:30.375Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-72791","description":"AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.","status":"published","published":"2026-09-08T14:02:30Z","modified":"2026-09-08T15:22:30Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T17:28:28.997972Z"}],"ghsa":[{"id":"GHSA-r768-j77w-2vwm","title":"AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete...","description":"AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.","status":"published","published":"2026-09-08T15:31:56Z","modified":"2026-09-08T15:32:05Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T15:11:28.397774Z"}],"nvd":[{"id":"CVE-2026-33197","description":"AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.","status":"published","published":"2026-09-08T15:18:42.96Z","modified":"2026-09-08T16:18:08.077Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:12:44.436435Z"}]}}