vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2019-12532

HIGH
7.8
CVSS Score
Published: August 26, 2019 at 05:06 PM UTC
Updated: June 17, 2026 at 02:14 AM UTC
6 products affected across 1 vendorH2OFFTH2OELVH2OOAE

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.4%

Description

Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

H2OELV· Insyde
95%
v < 100.00.02.08
Affected range stops below 100.00.02.08, so it looks safe — our inference, not a vendor statement
H2OFFT· Insyde
95%
100.00.00.00 ≤ v ≤ 100.00.08.23200.00.00.01 ≤ v ≤ 200.00.00.053.02 ≤ v ≤ 5.28
H2OOAE· Insyde
95%
v < 200.00.00.02
Affected range stops below 200.00.00.02, so it looks safe — our inference, not a vendor statement
H2OPCM· Insyde
95%
v < 100.00.06.00
Affected range stops below 100.00.06.00, so it looks safe — our inference, not a vendor statement
H2OSDE· Insyde
95%
v < 200.00.00.07
Affected range stops below 200.00.00.07, so it looks safe — our inference, not a vendor statement
H2OUVE· Insyde
95%
v < 200.00.02.02
Affected range stops below 200.00.02.02, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

x_refsource_MISCThird Party Advisory
Source: [email protected]
https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://security.netapp.com/advisory/ntap-20220223-0004/
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://www.insyde.com/security-pledge/SA-2019001

CVSS

7.8HIGH[email protected]
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card