An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information could optionally be stored in cleartext, which might lead to possible information disclosure.
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Insydeh2o | Insyde | 5.0 (including) | 5.0 (including) |
| Insydeh2o | Insyde | 5.1 (including) | 5.1 (including) |
| Insydeh2o | Insyde | 5.2 (including) | 5.2 (including) |
| Insydeh2o | Insyde | 5.3 (including) | 5.3 (including) |
| Insydeh2o | Insyde | 5.4 (including) | 5.4 (including) |
| Insydeh2o | Insyde | 5.5 (including) | 5.5 (including) |