Ryzen 5 3500 Firmware
Vendor:
First CVE: Nov 9, 2022 · Active for 3 years
16
Total CVEs
More Total CVEs than 93% of tracked products
8.0
Avg CVEs / Year
Higher CVE frequency than 95% of tracked products
7.3
Avg CVSS
Higher Avg CVSS than 49% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Ryzen 5 3500 Firmware over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 9, 2022
3 years ago
Most Recent CVE
Nov 14, 2023
987 days ago
CVE Severity & Scoring
Ryzen 5 3500 Firmware16 CVEs
38%
50%
13%
All CVEs353,173 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local8 (50.0%)
Network7 (43.8%)
Unknown0 (0.0%)
Physical1 (6.3%)
Adjacent Network0 (0.0%)
Attack Complexity
Low14 (87.5%)
High2 (12.5%)
Unknown0 (0.0%)
User Interaction
None16 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low10 (62.5%)
High0 (0.0%)
None6 (37.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-23820CRITICAL Failure to validate the AMD SMM communication buffer
may allow an attacker to corrupt the SMRAM potentially leading to arbitrary
code execution. | Nov 14, 2023 | 9.8 | 30 | NO | NO |
CVE-2023-20559HIGH
Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation of privileges.
| Apr 2, 2023 | 8.8 | 26 | NO | NO |
CVE-2023-20558HIGH
Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to an escalation of privileges.
| Apr 2, 2023 | 8.8 | 26 | NO | NO |
CVE-2021-26392HIGH Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS | Nov 9, 2022 | 7.8 | 25 | NO | NO |
CVE-2022-23821CRITICAL Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.
| Nov 14, 2023 | 9.8 | 24 | NO | NO |
CVE-2023-20593MEDIUM An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. | Jul 24, 2023 | 5.5 | 23 | NO | NO |
CVE-2021-26356HIGH A TOCTOU in ASP bootloader may allow an attacker
to tamper with the SPI ROM following data read to memory potentially resulting
in S3 data corruption and information disclosure.
| May 9, 2023 | 7.4 | 23 | NO | NO |
CVE-2021-26346MEDIUM Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resul | Jan 11, 2023 | 5.5 | 21 | NO | NO |
CVE-2023-20533HIGH Insufficient DRAM address validation in System
Management Unit (SMU) may allow an attacker to read/write from/to an invalid
DRAM address, potentially resulting in denial-of-service | Nov 14, 2023 | 7.5 | 20 | NO | NO |
CVE-2021-46774HIGH Insufficient DRAM address validation in System
Management Unit (SMU) may allow an attacker to read/write from/to an invalid
DRAM address, potentially resulting in denial-of-service | Nov 14, 2023 | 7.5 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (16 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (16 CVEs).
Media Mentions
Signals from CVEs in this product scope (16 CVEs).
Top CNAs Publishing CVEs For Ryzen 5 3500 Firmware
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| comboam4_v2_pi_1.2.0.8 | 2 | 9.8 | 0.8% | 0 | 0 |
| comboam4_pi_1.0.0.9 | 2 | 9.8 | 0.8% | 0 | 0 |