Back to Database
Status published
Medium
CVE-2025-4424
SetupAutomationSmm : Arbitrary calls to SmmSetVariable with unsanitised arguments in SMI handler
Vulnerability Description
The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/product_security/home
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-4424
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- BINARLY REsearch team
References
More from Insyde Software
View All →CVE-2025-4426
SetupAutomationSmm : SMRAM memory contents leak / information disclosure vulnerability in SMM module
Medium
6
CVE-2025-4425
SetupAutomationSmm: Stack overflow vulnerability in SMI handler
High
8.2
CVE-2025-4423
SetupAutomationSmm:Vulnerability in the SMM module allow attacker to write arbitrary code and lead to memory corruption
High
8.2
CVE-2025-4422
EfiSmiServices : EfiPcdProtocol, SMM memory corruption vulnerabilities in SMM module
High
8.2
CVE-2025-4421
EfiSmiServices: gEfiSmmCpuProtocol, SMM memory corruption vulnerabilities in SMM module
High
8.2
Affected Vendor
Insyde Software
View all reports →Affected Software
InsydeH2O
Vulnerable Versions:
Feature developed for Lenovo
Timeline
Official Publish:
July 30th, 2025
Last Modified:
August 14th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N