Improper input validation in AMD 2nd Gen AMD EPYC™
Priority LOW 31CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Improper validation of destination address in SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB in a malicious UApp or ABL may allow an attacker to overwrite arbitrary bootloader memory with SPI ROM contents resulting in a loss of integrity and availability.
Why it matters now
EPSS 0.00231 14th percentileScored 2026-11-07
Fix Fixed 2nd Gen AMD EPYC™ (AMD): RomePI-SP3_1.0.0.C3rd Gen AMD EPYC™ (AMD): MilanPI-SP3_1.0.0.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AMD | 2nd Gen AMD EPYC™ | before RomePI-SP3_1.0.0.C | RomePI-SP3_1.0.0.C | Patch available | CNA |
| AMD | 3rd Gen AMD EPYC™ | before MilanPI-SP3_1.0.0.4 | MilanPI-SP3_1.0.0.4 | Patch available | CNA |
- 2nd Gen AMD EPYC™ VendorAMD Affected before RomePI-SP3_1.0.0.C Fixed in RomePI-SP3_1.0.0.C Patch available CNA
- 3rd Gen AMD EPYC™ VendorAMD Affected before MilanPI-SP3_1.0.0.4 Fixed in MilanPI-SP3_1.0.0.4 Patch available CNA
CPE configurations NVD · 98
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:amd:epyc_7763_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7763:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7713p_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7713p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7713_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7713:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7663_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7663:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7643_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7643:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
- cpe:2.3:o:amd:epyc_7763_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7763:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7713p_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7713p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7713_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7713:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7663_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7663:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7643_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7643:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
Show 88 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:amd:epyc_75f3_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_75f3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7543p_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7543p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7543_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7543:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7513_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7513:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7453_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7453:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_74f3_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_74f3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7443p_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7443p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7443_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7443:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7413_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7413:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_73f3_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_73f3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7343_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7343:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7313p_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7313p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7313_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7313:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_72f3_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_72f3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7773x_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7773x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7473x_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7473x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7573x_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7573x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7373x_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7373x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7002_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7232p_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7232p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7252_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7252:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7262_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7262:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7272_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7272:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7282_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7282:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7302_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7302:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7302p_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7302p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7352_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7352:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7402_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7402:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7402p_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7402p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7452_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7452:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7502_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7502:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7502p_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7502p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7532_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7532:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7542_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7542:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7552_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7552:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7642_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7642:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7662_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7662:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7702_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7702:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7702p_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7702p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7742_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7742:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7f72_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7f72:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7f52_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7f52:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7f32_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7f32:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7h12_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7h12:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
- cpe:2.3:o:amd:epyc_75f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_75f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7543p_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7543p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7543_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7543:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7513_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7513:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7453_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7453:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_74f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_74f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7443p_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7443p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7443_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7443:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7413_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7413:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_73f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_73f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7343_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7343:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7313p_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7313p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7313_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7313:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_72f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_72f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7773x_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7773x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7473x_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7473x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7573x_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7573x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7373x_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7373x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7002_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7232p_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7232p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7252_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7252:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7262_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7262:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7272_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7272:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7282_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7282:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7302_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7302:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7302p_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7302p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7352_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7352:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7402_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7402:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7402p_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7402p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7452_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7452:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7502_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7502:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7502p_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7502p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7532_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7532:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7542_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7542:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7552_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7552:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7642_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7642:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7662_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7662:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7702_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7702:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7702p_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7702p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7742_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7742:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7f72_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7f72:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7f52_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7f52:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7f32_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7f32:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7h12_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7h12:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
Remediation
- Fix · CNA 2nd Gen AMD EPYC™ (AMD) Fixed in RomePI-SP3_1.0.0.C
- Fix · CNA 3rd Gen AMD EPYC™ (AMD) Fixed in MilanPI-SP3_1.0.0.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
AMD 3rd Gen AMD EPYC™ MilanPI-SP3_1.0.0.4
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2021-21486 Improper input validation in AMD 3rd Gen AMD EPYC™Priority LOW 34
- TI-2021-08151 A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs.Priority LOW 34
- TI-2021-08159 Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential…Priority LOW 31
- Release ·
AMD 2nd Gen AMD EPYC™ RomePI-SP3_1.0.0.C
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-08225 Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise…Priority LOW 31
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26370
- 2026-10-03 Alias added: GHSA-9hr4-cwvw-3xm2
References
More AMD Epyc 7002 Firmware vulnerabilities
- TI-2022-12252 Mis-trained branch predictions for return instructions may allow arbitrary speculative… CVSS 3.1MEDIUM 6.5
- TI-2021-08144 Improper input validation in AMD Ryzen 5000 Series CVSS 3.1HIGH 7.8
- TI-2021-08217 Out-of-bounds write in AMD 1st Gen EPYC CVSS 3.1HIGH 7.8
- TI-2021-08183 Time-of-check time-of-use race condition in AMD Ryzen™ 3000 Series Desktop Processors… CVSS 3.1HIGH 7.4
- TI-2020-10295 A potential denial of service (DoS) vulnerability exists in the integrated chipset that… CVSS 3.1HIGH 7.5
- TI-2023-07003 Memory corruption in AMD 2nd Gen EPYC CVSS 3.1HIGH 7.5
Sources
- CVE-2021-26370 · CVE Program
- CVE-2021-26370 · NVD
- FIRST EPSS
- GHSA-9hr4-cwvw-3xm2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences