SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2021-43613

MEDIUM · CVSS 6.5 EPSS 0.11%

Source: NVD + CISA KEV + EPSS · Published 2026-09-03 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

InsydeH2O's SysPasswordDxe component exposes user and administrator password hashes in runtime UEFI variables, allowing attackers to escalate privileges. This vulnerability poses a medium risk, particularly for systems relying on UEFI for secure boot processes. Organizations utilizing InsydeH2O firmware should prioritize remediation to mitigate potential unauthorized access risks.

CVE
CVE-2021-43613
Severity
MEDIUM
CVSS
6.5
EPSS
0.11%

Original NVD Description

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege