CVE-2023-20587 is an improper access control vulnerability in System Management Mode (SMM) that could allow an attacker to gain access to the SPI flash, potentially leading to arbitrary code execution. This vulnerability affects unspecified products. It carries a CVSS score of 7.1 (HIGH), indicating a local attack vector with low complexity, requiring low privileges, and resulting in high confidentiality and integrity impacts, but no availability impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| AMD | 1st Gen AMD EPYC™ Processors | variousCNA affecteddefault affected | |
| AMD | 2nd Gen AMD EPYC™ Processors | variousCNA affecteddefault unaffected | |
| AMD | 3rd Gen AMD EPYC™ Processors | various CNA affecteddefault unaffected | |
| AMD | 4th Gen AMD EPYC™ Processors | variousCNA affecteddefault unaffected | |
| AMD | AMD EPYC(TM) Embedded 3000 | variousCNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.