What’s Vulnerable › Vulnerabilities

CVE-2019-12532

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-08-26 · updated 2026-06-17

Description

Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08.

Affected products

• Insyde H2Oelv: before 100.00.02.08 — fixed in 100.00.02.08
• Insyde H2Offt: from 3.02 through 5.28; from 100.00.00.00 through 100.00.08.23; from 200.00.00.01 through 200.00.00.05
• Insyde H2Ooae: before 200.00.00.02 — fixed in 200.00.00.02
• Insyde H2Opcm: before 100.00.06.00 — fixed in 100.00.06.00
• Insyde H2Osde: before 200.00.00.07 — fixed in 200.00.00.07
• Insyde H2Ouve: before 200.00.02.02 — fixed in 200.00.02.02

How to fix

Upgrade to a fixed version: Insyde H2Oelv 100.00.02.08; Insyde H2Ooae 200.00.00.02; Insyde H2Opcm 100.00.06.00; Insyde H2Osde 200.00.00.07; Insyde H2Ouve 200.00.02.02. Check the vendor advisory for mitigations.

References

• https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/
• https://security.netapp.com/advisory/ntap-20220223-0004/
• https://www.insyde.com/security-pledge/SA-2019001
• https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/
• https://security.netapp.com/advisory/ntap-20220223-0004/
• https://www.insyde.com/security-pledge/SA-2019001

Get alerted when CVE-2019-12532 or the next vulnerability affects your stack