CVE-2021-41840
highpriority · track · 33EPSS 0.003 · 23 %ileDEEUUSEPSS · scored 2026-10-27
An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIMATIC Field PG M5siemens_psirt
Update to V22.01.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC Field PG M6siemens_psirt
Update to V26.01.13 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC127Esiemens_psirt
Update to V27.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC227Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC277Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC327Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC377Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC427Esiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC477Esiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC477E Prosiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC627Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC647Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC677Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC847Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC ITP1000siemens_psirt
Update to V23.01.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIMATIC IPC277G PROsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - FixedSIPLUS IPC427Esiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - MitigationSIMATIC Field PG M5siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC Field PG M6siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC127Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC227Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC277Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC327Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC377Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC427Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC477Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC477E Prosiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC627Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC647Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC677Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC847Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC ITP1000siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIMATIC IPC277G PROsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
- MitigationSIPLUS IPC427Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (38)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- SSA-306654SSA-306654: Insyde BIOS Vulnerabilities in Siemens Industrial Products2022-02-22csaf · siemens_psirtDE
Insyde has published information on vulnerabilities in Insyde BIOS in February 2022. This advisory lists the Siemens Industrial products affected by these vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (18)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdfcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-41840cnnvd
- https://security.netapp.com/advisory/ntap-20220217-0014/cnnvd
- https://support.lenovo.com/us/en/product_security/LEN-73436cnnvd
- https://vigilance.fr/vulnerability/Independent-BIOS-Developers-multiple-vulnerabilities-via-UEFI-37438cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2022020308cnnvd
- https://www.insyde.com/security-pledgePatchcnnvd
- https://www.insyde.com/security-pledge/SA-2022018cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan