CWE-1301
Insufficient or Incomplete Data Removal within Hardware Component
Monthly
Insufficient or Incomplete Data Removal in Hardware Component in SEV firmware doesn't fully flush IOMMU. This can potentially lead to a loss of confidentiality and integrity in guest memory.
Persistent denial of service affects Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5: a malicious or malformed installed app cannot be uninstalled, leaving the device unavailable. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates network-reachable, authenticated low-privilege exploitation, while the vendor's CVSS 4.0 vector claims PR:N and broader impact; authentication requirements for the app-installation function should be confirmed against the vendor advisory. No public exploit was identified at time of analysis, KEV status is not indicated, and EPSS is 0.22% (11th percentile), suggesting low observed exploitation likelihood.
Insufficient or Incomplete Data Removal in Hardware Component in SEV firmware doesn't fully flush IOMMU. This can potentially lead to a loss of confidentiality and integrity in guest memory.
Persistent denial of service affects Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5: a malicious or malformed installed app cannot be uninstalled, leaving the device unavailable. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates network-reachable, authenticated low-privilege exploitation, while the vendor's CVSS 4.0 vector claims PR:N and broader impact; authentication requirements for the app-installation function should be confirmed against the vendor advisory. No public exploit was identified at time of analysis, KEV status is not indicated, and EPSS is 0.22% (11th percentile), suggesting low observed exploitation likelihood.