Aptio V
Monthly
Local privilege escalation in AMI Aptio V (APTIOV) UEFI/BIOS firmware lets a low-privileged local actor push past a firmware authorization boundary and gain elevated rights, compromising the integrity and availability of the platform (CVSS v4.0 base 7.2; independent assessment CVSS v3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H). Exploitation requires an existing foothold on the host with a low-privileged account or local code execution - there is no network attack path, and confidentiality is not impacted. No public exploit was identified at time of analysis and the CVE is not in CISA KEV; EPSS is 0.12% (1st percentile), though the CVSS v4.0 vector records an E:P proof-of-concept exploit-maturity metric.
Memory buffer bounds violation in AMI Aptio V UEFI BIOS firmware allows a local low-privileged attacker to corrupt firmware memory, compromising system integrity and availability at the firmware layer. The flaw (CWE-119) operates below the operating system, meaning successful exploitation can subvert protections that survive OS reinstallation and bypass standard security tooling. No public exploit code has been identified and EPSS is 0.05%, indicating no observed exploitation activity at time of analysis.
Arbitrary code execution within the AMI Aptio V BIOS can be triggered by a local attacker with low-level privileges and a specific attack prerequisite, potentially compromising firmware integrity and availability. The vulnerability requires local access (PR:L), a specific attack requirement (AT:P), and passive user interaction (UI:P), but no public exploit code has been identified and EPSS is very low (0.16%, 5th percentile), so opportunistic mass exploitation is impractical. Apply the firmware update provided by your OEM per AMI advisory AMI-SA-2025008.
Out-of-bounds write in AMI Aptio V BIOS allows local low-privilege authenticated attackers to corrupt memory, leading to data loss and system unavailability. The vulnerability is rated medium (CVSS 4.0: 5.9) and has a very low EPSS score (0.05%), indicating minimal immediate exploitation risk, with a vendor advisory already released.
Local authenticated
APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.
AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Rated medium severity (CVSS 5.8). No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Rated high severity (CVSS 7.5). No vendor patch available.
AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Rated medium severity (CVSS 5.7). No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Rated high severity (CVSS 7.5). No vendor patch available.
APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An exploit is possible where an actor with physical access can manipulate SPI flash without being detected. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMRAM to kernel space, potentially leading. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS). Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS). Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Local privilege escalation in AMI Aptio V (APTIOV) UEFI/BIOS firmware lets a low-privileged local actor push past a firmware authorization boundary and gain elevated rights, compromising the integrity and availability of the platform (CVSS v4.0 base 7.2; independent assessment CVSS v3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H). Exploitation requires an existing foothold on the host with a low-privileged account or local code execution - there is no network attack path, and confidentiality is not impacted. No public exploit was identified at time of analysis and the CVE is not in CISA KEV; EPSS is 0.12% (1st percentile), though the CVSS v4.0 vector records an E:P proof-of-concept exploit-maturity metric.
Memory buffer bounds violation in AMI Aptio V UEFI BIOS firmware allows a local low-privileged attacker to corrupt firmware memory, compromising system integrity and availability at the firmware layer. The flaw (CWE-119) operates below the operating system, meaning successful exploitation can subvert protections that survive OS reinstallation and bypass standard security tooling. No public exploit code has been identified and EPSS is 0.05%, indicating no observed exploitation activity at time of analysis.
Arbitrary code execution within the AMI Aptio V BIOS can be triggered by a local attacker with low-level privileges and a specific attack prerequisite, potentially compromising firmware integrity and availability. The vulnerability requires local access (PR:L), a specific attack requirement (AT:P), and passive user interaction (UI:P), but no public exploit code has been identified and EPSS is very low (0.16%, 5th percentile), so opportunistic mass exploitation is impractical. Apply the firmware update provided by your OEM per AMI advisory AMI-SA-2025008.
Out-of-bounds write in AMI Aptio V BIOS allows local low-privilege authenticated attackers to corrupt memory, leading to data loss and system unavailability. The vulnerability is rated medium (CVSS 4.0: 5.9) and has a very low EPSS score (0.05%), indicating minimal immediate exploitation risk, with a vendor advisory already released.
Local authenticated
APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.
AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Rated medium severity (CVSS 5.8). No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Rated high severity (CVSS 7.5). No vendor patch available.
AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Rated medium severity (CVSS 5.7). No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Rated high severity (CVSS 7.5). No vendor patch available.
APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An exploit is possible where an actor with physical access can manipulate SPI flash without being detected. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMRAM to kernel space, potentially leading. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS). Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS). Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.