CVE-2023-39539highCWE-20CWE-434

CVE-2023-39539: high-severity vulnerability in AMI AptioV

Failure when uploading a Logo image file

Published · Updated

Follow this CVE+ Monitor AptioV

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.6%
In short

AMI AptioV BIOS allows local users to upload PNG logo files without proper validation, potentially compromising system security. An attacker with local access could exploit this to gain unauthorized control over the system.

Technical detail

This vulnerability in AMI AptioV BIOS involves improper input validation (CWE-20) and unrestricted file upload (CWE-434) affecting the logo image upload functionality. A local attacker can bypass file type restrictions to upload malicious PNG files, potentially leading to code execution or system compromise with impacts on confidentiality, integrity, and availability.

Summary generated and translated by AI from the official description.
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability. 
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
AMI · AptioV
Related CVEs — AMI AptioV

In the same product, most dangerous first.

CVE-2024-42442HIGHRuntime Service Access outside SMRAMEPSS 0.8%CVE-2023-34469MEDIUMCold Rest VulnerabiltiyEPSS 0.2%CVE-2023-39538HIGHFailure when uploading a Logo image fileEPSS 0.2%CVE-2023-39537HIGHImproper input validation in BIOS TCG2EPSS 0.2%CVE-2023-39536HIGHImproper input validation in BIOS OFBDEPSS 0.2%CVE-2023-39535HIGHImproper input validation in BIOS EPSS 0.2%