EUVD-2025-209793
GHSA-q59c-hw6f-x2m2
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with high privileges and complexity required; no scope change as subsequent-system impacts are absent; only confidentiality is affected.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper initialization in the UEFI firmware for some Intel platforms within Ring 0: Bare Metal OS may allow an information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
AnalysisAI
Improper initialization in Intel UEFI firmware (Ring 0 / Bare Metal OS layer) enables information disclosure on some Intel platforms. A system software-level adversary already holding high privileges can exploit this flaw under high-complexity, prerequisite-dependent conditions to expose sensitive memory contents, with confidentiality impact rated high but no integrity or availability effect. No public exploit exists and EPSS sits at 0.01% (2nd percentile), and SSVC classifies exploitation status as none - signals that are mutually consistent and indicate this is a low-urgency finding for most organizations.
Technical ContextAI
CWE-665 (Improper Initialization) indicates that one or more memory regions, buffers, or variables within the UEFI firmware are not correctly initialized before use, leaving residual data potentially readable by privileged actors. UEFI firmware executes at Ring 0 - the highest CPU privilege ring - below the operating system, meaning flaws at this layer have no OS-level isolation protecting them. The affected surface is specifically the Bare Metal OS context on certain Intel platforms, as identified via CPE cpe:2.3:a:n/a:intel_platforms:*:*:*:*:*:*:*:*. The uninitialized region could contain residual cryptographic material, configuration secrets, or other sensitive firmware-stage data depending on execution context and platform model.
RemediationAI
Consult Intel Security Advisory Intel-SA-01413 at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01413.html for the specific patched firmware versions and update procedures applicable to each affected platform. Apply the vendor-supplied UEFI firmware update through the OEM's recommended channel (BIOS update utility, Intel ME firmware tool, or platform management interface). An exact patched firmware version is not independently confirmed from the data available - treat the advisory as the authoritative source. For environments that cannot immediately schedule a firmware update window, compensating controls should focus on restricting who can operate at Ring 0 or system software privilege levels: enforce strict role separation, limit bare metal access to trusted operators, and audit privileged access logs. Enabling Secure Boot and Platform Firmware Resilience (PFR) policies does not directly mitigate this improper initialization flaw but reduces the attacker's ability to persist post-exploitation. Note that firmware updates require system reboots and may affect hardware compatibility - test on non-production platforms before broad deployment.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-665 – Improper Initialization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today