An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information could optionally be stored in cleartext, which might lead to possible information disclosure.
Weakness
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Insydeh2o | Insyde | 5.0 (including) | 5.0 (including) |
| Insydeh2o | Insyde | 5.1 (including) | 5.1 (including) |
| Insydeh2o | Insyde | 5.2 (including) | 5.2 (including) |
| Insydeh2o | Insyde | 5.3 (including) | 5.3 (including) |
| Insydeh2o | Insyde | 5.4 (including) | 5.4 (including) |
| Insydeh2o | Insyde | 5.5 (including) | 5.5 (including) |