Aptio V
Monthly
We need to produce a JSON object with all the specified fields. We'll synthesize the given data. First, extract the key info: - CVE-2025-33044 - Description: "APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local means. Successful exploitation of this vulnerability may lead to memory corruption and impact Integrity and Availability." - CVSS Score: 5.9 (CVSS:4.0 vector given) - CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) - EPSS: 0.05% (17th percentile) - low. - KEV status? Not mentioned, assume NO. - POC? Not mentioned, assume NO. - Tags: Buffer Overflow, Aptio V - CPE: cpe:2.3:o:ami:aptio_v:*:*:*:*:*:*:*:* - References: [nvd] https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025008.pdf (AMI Security Advisory) - Reported by: biossecurity@ami.com (so vendor provided info) Product name: "Aptio V" (UEFI BIOS/firmware from AMI). So product_name: "Aptio V". Short, 3 words. Summary: Synthesize original, do not paraphrase. Start with impact verb: "Memory corruption in AMI Aptio V BIOS allows local attackers to compromise system integrity and availability." then explain what and who affected. Mention that it's a buffer overflow (improper bounds check). Attacker with local access (as described). No KEV, no POC mentioned. EPSS low. So summary: "Memory corruption in AMI Aptio V BIOS allows local attackers to compromise system integrity and availability. The vulnerability, caused by improper bounds checking, can be exploited by local means to cause memory corruption, impacting integrity and availability. No active exploitation or public exploit has been reported, and EPSS indicates a low probability of widespread exploitation." Technical context: Underlying technology: UEFI BIOS firmware. CWE-119 relates to memory buffer operations. CPE shows AMI Aptio V is the product. So we can describe: AMI Aptio V is a UEFI BIOS firmware u
Out-of-bounds write in AMI Aptio V BIOS allows local low-privilege authenticated attackers to corrupt memory, leading to data loss and system unavailability. The vulnerability is rated medium (CVSS 4.0: 5.9) and has a very low EPSS score (0.05%), indicating minimal immediate exploitation risk, with a vendor advisory already released.
Local authenticated
APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.
AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Rated medium severity (CVSS 5.8). No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Rated high severity (CVSS 7.5). No vendor patch available.
AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Rated medium severity (CVSS 5.7). No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Rated high severity (CVSS 7.5). No vendor patch available.
APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An exploit is possible where an actor with physical access can manipulate SPI flash without being detected. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMRAM to kernel space, potentially leading. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS). Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS). Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
We need to produce a JSON object with all the specified fields. We'll synthesize the given data. First, extract the key info: - CVE-2025-33044 - Description: "APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local means. Successful exploitation of this vulnerability may lead to memory corruption and impact Integrity and Availability." - CVSS Score: 5.9 (CVSS:4.0 vector given) - CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) - EPSS: 0.05% (17th percentile) - low. - KEV status? Not mentioned, assume NO. - POC? Not mentioned, assume NO. - Tags: Buffer Overflow, Aptio V - CPE: cpe:2.3:o:ami:aptio_v:*:*:*:*:*:*:*:* - References: [nvd] https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025008.pdf (AMI Security Advisory) - Reported by: biossecurity@ami.com (so vendor provided info) Product name: "Aptio V" (UEFI BIOS/firmware from AMI). So product_name: "Aptio V". Short, 3 words. Summary: Synthesize original, do not paraphrase. Start with impact verb: "Memory corruption in AMI Aptio V BIOS allows local attackers to compromise system integrity and availability." then explain what and who affected. Mention that it's a buffer overflow (improper bounds check). Attacker with local access (as described). No KEV, no POC mentioned. EPSS low. So summary: "Memory corruption in AMI Aptio V BIOS allows local attackers to compromise system integrity and availability. The vulnerability, caused by improper bounds checking, can be exploited by local means to cause memory corruption, impacting integrity and availability. No active exploitation or public exploit has been reported, and EPSS indicates a low probability of widespread exploitation." Technical context: Underlying technology: UEFI BIOS firmware. CWE-119 relates to memory buffer operations. CPE shows AMI Aptio V is the product. So we can describe: AMI Aptio V is a UEFI BIOS firmware u
Out-of-bounds write in AMI Aptio V BIOS allows local low-privilege authenticated attackers to corrupt memory, leading to data loss and system unavailability. The vulnerability is rated medium (CVSS 4.0: 5.9) and has a very low EPSS score (0.05%), indicating minimal immediate exploitation risk, with a vendor advisory already released.
Local authenticated
APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.
AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Rated medium severity (CVSS 5.8). No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Rated high severity (CVSS 7.5). No vendor patch available.
AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Rated medium severity (CVSS 5.7). No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Rated high severity (CVSS 7.5). No vendor patch available.
APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An exploit is possible where an actor with physical access can manipulate SPI flash without being detected. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMRAM to kernel space, potentially leading. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS). Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS). Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.