CVE-2025-4426

SetupAutomationSmm : SMRAM memory contents leak / information disclosure vulnerability in SMM module

CVSS 6 MEDIUMEPSS 0.2%CWE-200

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

30 Jul 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/product_security/home

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Affected products

Insyde Software · InsydeH2O

References

https://support.lenovo.com/us/en/product_security/home https://www.insyde.com/security-pledge/sa-2025007/