« Volver al listado

CVE-2019-12532

Estado: ModificadaAlta (7.8)—

Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (6)

Insyde — H2oelvInsyde — H2offtInsyde — H2ooaeInsyde — H2opcmInsyde — H2osdeInsyde — H2ouve

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-12532",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-26T18:15:11.797",
  "references": [
    {
      "url": "https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20220223-0004/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.insyde.com/security-pledge/SA-2019001",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20220223-0004/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.insyde.com/security-pledge/SA-2019001",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08."
    },
    {
      "lang": "es",
      "value": "El control de acceso inadecuado en las herramientas de software de Insyde puede permitir que un usuario autenticado permita potencialmente la escalada de privilegios o la divulgación de información a través del acceso local. Esta es una vulnerabilidad de software, no un problema de firmware. Las herramientas afectadas incluyen: H2OFFT versión 3.02 ~ 5.28, 100.00.00.00 ~ 100.00.08.23 y 200.00.00.01 ~ 200.00.00.05, H2OOAE antes de la versión 200.00.00.02, H2OSDE antes de la versión 200.00.00.07, H2OUVE antes de la versión 200.00.02.02, H2OPCM antes de la versión 100.00.06.00, H2OELV antes de la versión 100.00.02.08."
    }
  ],
  "lastModified": "2026-06-17T02:14:50.423",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:insyde:h2oelv:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A64F3B59-F104-4DEE-A196-DCBD76F790CC",
              "versionEndExcluding": "100.00.02.08"
            },
            {
              "criteria": "cpe:2.3:a:insyde:h2offt:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BF51709-D72C-4E4E-B92D-B78553BDCE97",
              "versionEndIncluding": "5.28",
              "versionStartIncluding": "3.02"
            },
            {
              "criteria": "cpe:2.3:a:insyde:h2offt:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A4D96B2-1C62-4F7D-95A5-9587808AE832",
              "versionEndIncluding": "100.00.08.23",
              "versionStartIncluding": "100.00.00.00"
            },
            {
              "criteria": "cpe:2.3:a:insyde:h2offt:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6894832B-0015-46A3-8BB5-46D35FE9F9D5",
              "versionEndIncluding": "200.00.00.05",
              "versionStartIncluding": "200.00.00.01"
            },
            {
              "criteria": "cpe:2.3:a:insyde:h2ooae:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5410FBD1-F831-4740-991D-2A38C989FF8B",
              "versionEndExcluding": "200.00.00.02"
            },
            {
              "criteria": "cpe:2.3:a:insyde:h2opcm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B7CD64C-5D98-4457-A834-BC1DDC4C94BA",
              "versionEndExcluding": "100.00.06.00"
            },
            {
              "criteria": "cpe:2.3:a:insyde:h2osde:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B75D2834-4B85-4473-9B66-36A608C00C52",
              "versionEndExcluding": "200.00.00.07"
            },
            {
              "criteria": "cpe:2.3:a:insyde:h2ouve:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C1B7A5E-F3AA-4AD3-AE9B-92D12C542753",
              "versionEndExcluding": "200.00.02.02"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}