CVE Feed

    Dashboard / CVE / CVE-2022-40261

    CVE-2022-40261

    An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS) and completely isolated from it. Running arbitrary code in SMM additionally bypasses SMM-based SPI flash protections against modifications, which can help an attacker to install a firmware backdoor/implant into BIOS. Such a malicious firmware code in BIOS could persist across operating system re-installs. Additionally, this vulnerability potentially could be used by malicious actors to bypass security mechanisms provided by UEFI firmware (for example, Secure Boot and some types of memory isolation for hypervisors). This issue affects: Module name: OverClockSmiHandler SHA256: a204699576e1a48ce915d9d9423380c8e4c197003baf9d17e6504f0265f3039c Module GUID: 4698C2BD-A903-410E-AD1F-5EEF3A1AE422

    Published:Sep 20, 2022
    Last Modified:May 28, 2025
    EPS:Sep 20, 2022
    EPSS Score:0.0003
    CVSS Score:8.2

    Affected Products

    Vendor
    Ami
    Product
    Aptio V
    Vendor
    Intel
    Product
    Nuc M15 Laptop Kit Lapbc510
    Vendor
    Intel
    Product
    Nuc M15 Laptop Kit Lapbc510 Firmware
    Vendor
    Intel
    Product
    Nuc M15 Laptop Kit Lapbc710
    Vendor
    Intel
    Product
    Nuc M15 Laptop Kit Lapbc710 Firmware

    Exploits

    https://www.binarly.io/advisories/BRLY-2022-003https://www.binarly.io/advisories/BRLY-2022-003

    Related CVEs

    CVE-2026-33197 (CVSS 8.7) — AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallow…
    CVE-2025-58770 (CVSS 7.2) — APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions …
    CVE-2025-33044 (CVSS 5.9) — APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations with…
    CVE-2025-22833 (CVSS 4.6) — APTIOV contains a vulnerability in BIOS where an attacker may cause a Buffer Copy without Checking Size of Inp…
    CVE-2025-22832 (CVSS 5.9) — APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successfu…
    CVE-2025-22831 (CVSS 5.9) — APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successfu…
    CVE-2025-33045 (CVSS 8.2) — APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and…
    CVE-2025-22830 (CVSS 7.3) — APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. A suc…
    CVE-2025-22834 (CVSS 4.2) — AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessin…
    CVE-2025-33043 (CVSS 5.8) — APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Succ…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High