VU#553437: InsydeH2O IHISI SMM is vulnerable to unsafe memory write operations
2026-10-01T20:52:02Z•d92626f79c993e7c5c1740b2a03f999716fc48c1648bd468086ce9524f0948c8
CVE-2026-12855CVE-2026-18311CVE-2026-18312CVE-2026-75907CVE-2026-82356CVE-2026-82987CVE-2026-82988CVE-2026-82989CVE-2026-86867CVE-2026-96760AndroidAuthlibBIOSCERT/CCIoTJWSKotaemonRFIDSMMXSSarbitrary-memory-writeauthentication-bypassauthorization-bypassdata-exfiltrationenterprise-authenticationfirmwarekey-managementphysical-accessremote-code-executionsmartboard
What happened
The CERT/CC feed describes multiple newly disclosed vulnerabilities affecting firmware, authentication libraries, mobile applications, smartboard systems, physical access control, enterprise identity infrastructure, and multi-user AI applications. Impacts include arbitrary SMM memory writes and possible firmware compromise, JWS signature-verification bypass, stored XSS, unauthenticated screen capture and device compromise, clonable RFID credentials, persistent appliance impersonation due to non-rotatable keys, and cross-user conversation access and modification. Several issues enable severe or
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- d92626f79c993e7c5c1740b2a03f999716fc48c1648bd468086ce9524f0948c8
- Enrichment time
- 2026-10-01T20:52:02Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.