Security readout for executives and security teams
Plain-English summary
This is a firmware-level issue in InsydeH2O. On affected systems, a highly privileged local attacker could alter UEFI variables, affecting device integrity and potentially startup behavior. Public data does not identify specific OEM models, so exposure depends on installed firmware versions.
Executive priority
Treat as a firmware integrity risk, not an internet-facing emergency. Prioritize asset identification and firmware update planning, especially for high-value endpoints and systems exposed to local privilege compromise.
Technical view
CVE-2023-28149 affects the IhisiServiceSmm module in InsydeH2O kernel 5.2 through 5.6 before listed fixed builds. The CVSS vector indicates local access, high complexity, high privileges, no user interaction, high integrity impact, and low availability impact.
Likely exposure
Organizations may be exposed if laptops, desktops, servers, or appliances use InsydeH2O firmware with the affected kernel builds. The source bundle does not name downstream vendors or product models.
Exploitation context
No CISA KEV listing or provided source indicates active exploitation. The CVSS vector suggests exploitation requires local access and high privileges, which lowers broad remote risk but matters after endpoint compromise.
Researcher notes
Evidence is limited to the CVE record and Insyde advisory reference. Affected downstream products are not enumerated, no CWE is provided, and exploitation evidence is absent in the supplied sources.
Mitigation direction
- Check Insyde advisory SA-2023040 and OEM firmware guidance.
- Update firmware to builds containing the fixed InsydeH2O kernel versions.
- Prioritize systems where attackers could gain local administrator-level access.
- Track OEM advisories because end-user device models are not listed.
Validation and detection
- Inventory systems using InsydeH2O firmware.
- Identify the InsydeH2O kernel branch and build version.
- Compare versions against the fixed thresholds in the CVE description.
- Confirm OEM firmware packages include the relevant Insyde fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-28149 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L0.84.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.insyde.com/security-pledge/SA-2023040CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.