AMI vulnerabilities

69 vulnerabilities

Known vulnerabilities in AMI products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.

Products

10
5.8CVE-2026-0893amiaptiov
EPSS score
0.12%
AMI APTIOV contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability can lead to information disclosure, privilege escalation, and further impact on Confidentiality, Integrity, and Availability.8.3CVE-2025-58774amiaptiov
EPSS score
0.12%
AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.7.1CVE-2025-58773amiaptiov
EPSS score
0.11%
AMI APTIOV contains vulnerabilities in BIOS where users may cause  "Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.8.2CVE-2025-58772amiaptiov
EPSS score
0.12%
AMI APTIOV contains vulnerabilities in BIOS where users may cause  “Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.7.1CVE-2025-58771amiaptiov
EPSS score
0.11%
AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.8.8CVE-2025-58770amiaptio_v+1
EPSS score
0.12%
APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions or Privileges” by local access. Successful exploitation of this vulnerability can lead to escalation of authorization and potentially impact Integrity and Availability.7.3CVE-2025-22830amiaptio_v+1
EPSS score
0.09%
APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. A successful exploitation of this vulnerability may lead to resource exhaustion and impact Confidentiality, Integrity, and Availability.7.8CVE-2025-22832amiaptio_v+1
EPSS score
0.15%
APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability.7.8CVE-2025-22831amiaptio_v+1
EPSS score
0.15%
APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability.7.3CVE-2025-22833amiaptio_v+1
EPSS score
0.16%
APTIOV contains a vulnerability in BIOS where an attacker may cause a Buffer Copy without Checking Size of Input by local accessing. Successful exploitation of this vulnerability may lead to arbitrary code execution.5.3CVE-2025-22834amiaptio_v+1
EPSS score
0.13%
AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Successful exploitation of this vulnerability may leave the resource in an unexpected state and potentially impact confidentiality, integrity, and availability.8.2CVE-2025-33045amiaptio_v+1
EPSS score
0.16%
APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access. The successful exploitation of these vulnerabilities can lead to information disclosure, arbitrary data writing, and impact Confidentiality, Integrity, and Availability.6.1CVE-2025-33043amiaptio_v+1
EPSS score
0.18%
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exploitation of this vulnerability can potentially impact of integrity.7.8CVE-2025-33044amiaptio_v+1
EPSS score
0.15%
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local means. Successful exploitation of this vulnerability may lead to memory corruption and impact Integrity and Availability.8.2CVE-2022-40262amiaptio+2
EPSS score
0.33%
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: S3Resume2Pei SHA256: 7bb29f05534a8a1e010443213451425098faebd45948a4642db969b19d0253fc Module GUID: 89E549B0-7CFE-449D-9BA3-10D8B2312D719.8CVE-2022-40242amimegarac_sp-x+2
EPSS score
0.68%
MegaRAC Default Credentials Vulnerability5.3CVE-2022-40258amimegarac_spx-12+1
EPSS score
0.41%
AMI Megarac Weak password hashes for Redfish & API8.2CVE-2022-40261amiaptio+3
EPSS score
0.36%
An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS) and completely isolated from it. Running arbitrary code in SMM additionally bypasses SMM-based SPI flash protections against modifications, which can help an attacker to install a firmware backdoor/implant into BIOS. Such a malicious firmware code in BIOS could persist across operating system re-installs. Additionally, this vulnerability potentially could be used by malicious actors to bypass security mechanisms provided by UEFI firmware (for example, Secure Boot and some types of memory isolation for hypervisors). This issue affects: Module name: OverClockSmiHandler SHA256: a204699576e1a48ce915d9d9423380c8e4c197003baf9d17e6504f0265f3039c Module GUID: 4698C2BD-A903-410E-AD1F-5EEF3A1AE4229.8CVE-2022-40259amimegarac_sp-x+2
EPSS score
0.67%
MegaRAC Default Credentials Vulnerability7.2CVE-2022-40246amiaptio+2
EPSS score
0.49%
A potential attacker can write one byte by arbitrary address at the time of the PEI phase (only during S3 resume boot mode) and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: SbPei SHA256: d827182e5f9b7a9ff0b9d3e232f7cfac43b5237e2681e11f005be627a49283a9 Module GUID: c1fbd624-27ea-40d1-aa48-94c3dc5c7e0d