---
id: CVE-2021-33627
title: >-
  An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1
  before 05.17.11, 5.2 before 05.27.11, 5.3 before 05.36.11, 5.4 before
  05.44.11, and 5.5 before 05.52.11 affecting FwBlockServiceSmm
summary: >-
  An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1
  before 05.17.11, 5.2 before 05.27.11, 5.3 before 05.36.11, 5.4 before
  05.44.11, and 5.5 before 05.52.11 affecting FwBlockServiceSmm. Software SMI
  services that u…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-119
vendor: insyde
product: insydeh2o
affected:
  - 'insydeh2o >= 5.0, < 5.08.29'
  - 'insydeh2o >= 5.1, < 5.16.29'
  - 'insydeh2o >= 5.2, < 5.26.29'
  - 'insydeh2o >= 5.3, < 5.35.29'
  - simatic_field_pg_m5_firmware
  - simatic_field_pg_m6_firmware
  - simatic_ipc127e_firmware
  - simatic_ipc227g_firmware
  - simatic_ipc277g_firmware
  - simatic_ipc327g_firmware
  - simatic_ipc377g_firmware
  - simatic_ipc427e_firmware
  - simatic_ipc477e_firmware
  - simatic_ipc627e_firmware
  - simatic_ipc647e_firmware
  - simatic_ipc677e_firmware
  - simatic_ipc847e_firmware
  - simatic_itp1000_firmware
patched:
  - insydeh2o 5.35.29
published: '2022-02-03'
updated: '2026-08-11'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-33627'
references:
  - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20220222-0002/'
    label: cve@mitre.org
  - url: 'https://www.insyde.com/security-pledge'
    label: cve@mitre.org
  - url: 'https://www.insyde.com/security-pledge/SA-2022022'
    label: cve@mitre.org
  - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20220222-0002/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.insyde.com/security-pledge'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.insyde.com/security-pledge/SA-2022022'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.kb.cert.org/vuls/id/796611'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-306654.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.00328
epssPercentile: 0.23243
ingestedAt: '2026-08-11T16:47:01.776Z'
---

## Overview

An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1 before 05.17.11, 5.2 before 05.27.11, 5.3 before 05.36.11, 5.4 before 05.44.11, and 5.5 before 05.52.11 affecting FwBlockServiceSmm. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.

## Affected

- `insydeh2o >= 5.0, < 5.08.29`
- `insydeh2o >= 5.1, < 5.16.29`
- `insydeh2o >= 5.2, < 5.26.29`
- `insydeh2o >= 5.3, < 5.35.29`
- `simatic_field_pg_m5_firmware`
- `simatic_field_pg_m6_firmware`
- `simatic_ipc127e_firmware`
- `simatic_ipc227g_firmware`
- `simatic_ipc277g_firmware`
- `simatic_ipc327g_firmware`
- `simatic_ipc377g_firmware`
- `simatic_ipc427e_firmware`
- `simatic_ipc477e_firmware`
- `simatic_ipc627e_firmware`
- `simatic_ipc647e_firmware`
- `simatic_ipc677e_firmware`
- `simatic_ipc847e_firmware`
- `simatic_itp1000_firmware`

## Remediation

Upgrade past the affected range:

- `insydeh2o 5.35.29`