Read the docs

AMI

Records69All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical10CVSS 9.0–10.0
CVSS high42CVSS 7.0–8.9

Exploited now

AMI records in CISA KEV

Components

Products in the NVD configurations · select one to filter the records

Records

30 records in Aptio V · all components

Priority HIGH 73

An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS) and completely isolate…

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00497 Published 2022-09-20 No fix listed CWE-121
Priority HIGH 71

An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS) and completely isolate…

CVSS 3.1HIGH 8.2 Local High privileges No interaction EPSS 0.00356 Published 2022-09-20 No fix listed CWE-120
TI-2022-10117 CVE-2022-26873 · GHSA-8vmj-6582-mgcq

Stack-based buffer overflow in AMI Aptio

Priority HIGH 69

A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages.

CVSS 3.1HIGH 8.2 Local High privileges No interaction EPSS 0.00418 Published 2022-09-20 No fix listed CWE-121
TI-2024-28413 CVE-2024-42442 · GHSA-jjfc-8563-3h89

Runtime Service Access outside SMRAM

Priority MEDIUM 42

APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00811 Published 2024-11-12 No fix listed CWE-119
Priority LOW 37

APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access.

CVSS 3.1HIGH 8.2 Local High privileges No interaction EPSS 0.00159 Published 2025-09-09 Fixed in AptioV_5.040 CWE-123
TI-2023-20671 CVE-2023-39539 · GHSA-xhch-7j88-pg68

Failure when uploading a Logo image file

Priority LOW 37

AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00623 Published 2023-12-06 Fixed in BKS_5.34 CWE-20
TI-2024-28414 CVE-2024-42444 · GHSA-45gf-27xm-h64q

TOCTOU Race Condition between DMA and SMM

Priority LOW 35

APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00115 Published 2025-01-14 No fix listed CWE-367
TI-2024-22241 CVE-2024-33657 · GHSA-8fgq-vqp8-467c

Smm Callout in SmmComputrace Module

Priority LOW 35

This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMRAM to kernel space, potentially leading to denial-of-service…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00193 Published 2024-08-21 No fix listed CWE-20
TI-2024-22240 CVE-2024-33656 · GHSA-fm2v-78x9-f367

Memory Leak in SmmComuptrace Module

Priority LOW 35

The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00162 Published 2024-08-21 No fix listed CWE-269
TI-2023-20670 CVE-2023-39538 · GHSA-87fm-wcxm-mcmx

Failure when uploading a Logo image file

Priority LOW 35

AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00224 Published 2023-12-06 Fixed in BKS_5.34 CWE-20
TI-2023-20669 CVE-2023-39537 · GHSA-8xcg-x869-mp3h

Improper input validation in BIOS TCG2

Priority LOW 35

AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00206 Published 2023-11-14 No fix listed CWE-20
TI-2023-20668 CVE-2023-39536 · GHSA-89h7-qc9f-rwmp

Improper input validation in BIOS OFBD

Priority LOW 35

AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00206 Published 2023-11-14 No fix listed CWE-20
TI-2023-20667 CVE-2023-39535 · GHSA-r22x-56pw-w758

Improper input validation in BIOS

Priority LOW 35

AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00206 Published 2023-11-14 No fix listed CWE-20
TI-2023-17295 CVE-2023-34470 · GHSA-2w27-grg7-mp25

Improper access control in AMI AptioV

Priority LOW 35

AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00163 Published 2023-09-12 No fix listed CWE-284
TI-2024-36204 CVE-2024-54084 · GHSA-4prc-vpwg-w736

SMM Arbitrary Write via TOCTOU Vulnerability

Priority LOW 34

APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means.

CVSS 3.1HIGH 7.5 Local High privileges No interaction EPSS 0.00116 Published 2025-03-11 No fix listed CWE-367
TI-2024-28415 CVE-2024-42446 · GHSA-pgm8-5pfj-3v9h

TOCTOU in SmmWhea

Priority LOW 34

APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means.

CVSS 3.1HIGH 7.5 Local High privileges No interaction EPSS 0.00135 Published 2025-05-13 No fix listed CWE-367
TI-2025-16711 CVE-2025-22830 · GHSA-x68q-pxpj-5qrp

SmiFlash Race Condition Vulnerability

Priority LOW 33

APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access.

CVSS 4.0HIGH 7.3 Local High privileges User interaction EPSS 0.00102 Published 2025-08-12 No fix listed CWE-362
TI-2025-36428 CVE-2025-58770 · GHSA-5gw4-7cfm-h82q

TCG2 TPM RT Not Locked Issue

Priority LOW 30

APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions or Privileges” by local access.

CVSS 4.0HIGH 7.2 Local Low privileges No interaction EPSS 0.00117 Published 2025-12-12 Fixed in AptioV_5.041 CWE-280
TI-2024-02152 CVE-2024-2315 · GHSA-xf4p-4gf4-v92p

SMM arbitrary code execution in Overclock

Priority LOW 29

APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00128 Published 2024-11-12 No fix listed CWE-284
TI-2025-24036 CVE-2025-33043 · GHSA-q358-6958-pqcv

SMM buffer Integrity

Priority LOW 26

APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally.

CVSS 3.1MEDIUM 6.1 Local Low privileges No interaction EPSS 0.00183 Published 2025-05-29 No fix listed CWE-20
TI-2025-24037 CVE-2025-33044 · GHSA-rgvh-2933-hp94

exFat Memory Corruption Issue

Priority LOW 25

APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local means.

CVSS 4.0MEDIUM 5.8 Local Low privileges No interaction EPSS 0.00153 Published 2025-10-14 Fixed in AptioV_5.040 CWE-119
Priority LOW 25

APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local.

CVSS 4.0MEDIUM 5.8 Local Low privileges No interaction EPSS 0.00153 Published 2025-10-14 Fixed in AptioV_5.040 CWE-787
Priority LOW 25

APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local.

CVSS 4.0MEDIUM 5.8 Local Low privileges No interaction EPSS 0.00153 Published 2025-10-14 Fixed in AptioV_5.040 CWE-787
Priority LOW 25

AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker.

CVSS 4.0MEDIUM 5.7 Local High privileges No interaction EPSS 0.0016 Published 2025-02-11 No fix listed CWE-20
Load more
Open these records in search →