Common Weakness Enumeration

CWE-1277

Allowed

Firmware Not Updateable

Abstraction: Base · Status: Draft

The product does not provide its users with the ability to update or patch its firmware to address any vulnerabilities or weaknesses that may be present.

2 vulnerabilities reference this CWE, most recent first.

CVE-2026-6484 (GCVE-0-2026-6484)

Vulnerability from cvelistv5 – Published: 2026-08-12 00:20 – Updated: 2026-08-12 12:39

Title

Lack of verified boot to certain FV may cause arbitrary code execution

Summary

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 12:39 UTC

CWE

CWE-1277 - Insufficient Verification of Data Authenticity in Firmware

Assigner

Insyde

References

1 reference

URL	Tags
https://www.insyde.com/security-pledge/sa-2026003/

Impacted products

1 product

Vendor	Product	Version
Insyde Software	InsydeH2O	Unknown: See in the Solution

Date Public

2026-08-12 00:04

Credits

Thanks to Nikolaj Schlej, independent firmware security researcher, for reporting the vulnerability and engaging in this coordinated disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6484",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T12:39:19.055017Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T12:39:26.057Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "x86"
          ],
          "product": "InsydeH2O",
          "vendor": "Insyde Software",
          "versions": [
            {
              "status": "unknown",
              "version": "See in the Solution"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Thanks to Nikolaj Schlej, independent firmware security researcher, for reporting the vulnerability and engaging in this coordinated disclosure."
        }
      ],
      "datePublic": "2026-08-12T00:04:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution."
            }
          ],
          "value": "In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1277",
              "description": "CWE-1277: Insufficient Verification of Data Authenticity in Firmware",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T00:20:36.095Z",
        "orgId": "8338d8cb-57f7-4252-abc0-96fd13e98d21",
        "shortName": "Insyde"
      },
      "references": [
        {
          "url": "https://www.insyde.com/security-pledge/sa-2026003/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003eIntel Mobile Platforms:\u003c/strong\u003e\u003cbr\u003ePanther Lake: Unaffected\u003cbr\u003eLunar Lake: Unaffected\u003cbr\u003eAarow Lake H/U: Version 05.56.17.0022\u003cbr\u003eAarow Lake S/HX: Version 05.56.17.0037\u003cbr\u003eRapter Lake: Version 05.47.24.0058\u003cbr\u003eTwin Lake: Version 05.44.45.0029\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eIntel Server/Embedded platforms:\u003cbr\u003e\u003c/strong\u003eWhitley (CLX/CPX/ICX): Trunk\u003cbr\u003eCedarIsland (CPX): Trunk\u003cbr\u003eEagle Stream: Unaffected\u003cbr\u003eBirch Stream: Unaffected\u003cbr\u003eMehlow/Mehlow-R(CFL-S): Unaffected\u003cbr\u003eTatlow (RKS): Unaffected\u003cbr\u003eJacobsville(SNR): Trunk\u003cbr\u003eIdaville: Trunk\u003cbr\u003eKaseyville: Unaffected\u003cbr\u003eWhiskey Lake: Trunk\u003cbr\u003eCome tLake-S: Unaffected\u003cbr\u003eTiger Lake UP3/H: Unaffected\u003cbr\u003eAlder Lake: Version 05.47.24.2057\u003cbr\u003eRaptor Lake: Version 05.47.24.0057\u003cbr\u003eMeteor Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022\u003cbr\u003eMeteor Lake \u2013 PS ARL-H/U: Version 05.56.07.0022\u003cbr\u003eArrow Lake \u2013 S ARL-S/HX: Version 05.55.45.0036\u003cbr\u003eArrow Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022\u003cbr\u003eElkhart Lake: Version 05.48.17.0030\u003cbr\u003eAlder Lake N: Trunk\u003cbr\u003eAmston Lake: Trunk\u003cbr\u003eTwin Lake: Trunk\u003c/p\u003e"
            }
          ],
          "value": "Intel Mobile Platforms:\nPanther Lake: Unaffected\nLunar Lake: Unaffected\nAarow Lake H/U: Version 05.56.17.0022\nAarow Lake S/HX: Version 05.56.17.0037\nRapter Lake: Version 05.47.24.0058\nTwin Lake: Version 05.44.45.0029\n\n\n\n\u00a0\n\n\n\nIntel Server/Embedded platforms:\nWhitley (CLX/CPX/ICX): Trunk\nCedarIsland (CPX): Trunk\nEagle Stream: Unaffected\nBirch Stream: Unaffected\nMehlow/Mehlow-R(CFL-S): Unaffected\nTatlow (RKS): Unaffected\nJacobsville(SNR): Trunk\nIdaville: Trunk\nKaseyville: Unaffected\nWhiskey Lake: Trunk\nCome tLake-S: Unaffected\nTiger Lake UP3/H: Unaffected\nAlder Lake: Version 05.47.24.2057\nRaptor Lake: Version 05.47.24.0057\nMeteor Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022\nMeteor Lake \u2013 PS ARL-H/U: Version 05.56.07.0022\nArrow Lake \u2013 S ARL-S/HX: Version 05.55.45.0036\nArrow Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022\nElkhart Lake: Version 05.48.17.0030\nAlder Lake N: Trunk\nAmston Lake: Trunk\nTwin Lake: Trunk"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Lack of verified boot to certain FV may cause arbitrary code execution",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8338d8cb-57f7-4252-abc0-96fd13e98d21",
    "assignerShortName": "Insyde",
    "cveId": "CVE-2026-6484",
    "datePublished": "2026-08-12T00:20:36.095Z",
    "dateReserved": "2026-04-17T06:07:36.576Z",
    "dateUpdated": "2026-08-12T12:39:26.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-GH4J-3CG6-8M5X

Vulnerability from github – Published: 2026-08-12 03:31 – Updated: 2026-08-12 03:31

Details

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-6484"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1277"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-12T01:17:08Z",
    "severity": "HIGH"
  },
  "details": "In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.",
  "id": "GHSA-gh4j-3cg6-8m5x",
  "modified": "2026-08-12T03:31:17Z",
  "published": "2026-08-12T03:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6484"
    },
    {
      "type": "WEB",
      "url": "https://www.insyde.com/security-pledge/sa-2026003"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Mitigation

Requirements

Specify requirements to include the ability to update the firmware. Include integrity checks and authentication to ensure that untrusted firmware cannot be installed.

Mitigation

Architecture and Design

Design the device to allow for updating the firmware. Ensure that the design specifies how to distribute the updates and ensure their integrity and authentication.

Mitigation

Implementation

Implement the necessary functionality to allow the firmware to be updated.

CAPEC-682: Exploitation of Firmware or ROM Code with Unpatchable Vulnerabilities

An adversary may exploit vulnerable code (i.e., firmware or ROM) that is unpatchable. Unpatchable devices exist due to manufacturers intentionally or inadvertently designing devices incapable of updating their software. Additionally, with updatable devices, the manufacturer may decide not to support the device and stop making updates to their software.

← Back to the CWE list