A high-severity memory corruption vulnerability in InsydeH2O firmware could allow a local, highly privileged attacker to execute arbitrary code within the highly sensitive System Management Mode.

This flaw involves improper input validation (CWE-20) within the UsbCoreDxe component. A local attacker with high privileges can exploit this to write to arbitrary memory locations within SMRAM, which operates at the highest level of privilege in the system.

Successful exploitation grants an attacker execution capabilities within System Management Mode, which is effectively invisible to the host operating system. This level of access allows for persistent, undetectable compromise of the platform, including the potential to bypass secure boot mechanisms, exfiltrate sensitive data, or disable security controls. Given the CVSS score of 7.5, this poses a significant risk to organizational integrity and platform trust.

Immediate Action: Update the affected InsydeH2O firmware to the versions specified in the vendor security advisory (SA-2025005), specifically versions 05.39.18, 05.47.18, 05.55.18, 05.62.18, or 05.71.18 depending on the kernel version.

Proactive Monitoring: Monitor device logs for unexpected firmware reconfiguration events or signs of unauthorized integrity check failures.

Compensating Controls: Ensure that physical access to hardware is strictly controlled and that BIOS/UEFI password protection is enabled to prevent unauthorized firmware configuration changes.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a critical risk to system integrity due to its potential for SMM-level code execution. Administrators should prioritize the deployment of vendor-provided firmware updates across all affected hardware assets to mitigate the risk of persistent, low-level compromise.