---
id: CVE-2021-42059
title: >-
  An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41, Kernel
  5.1 before 05.16.41, Kernel 5.2 before 05.26.41, Kernel 5.3 before 05.35.41,
  and Kernel 5.4 before 05.42.20
summary: >-
  An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41, Kernel
  5.1 before 05.16.41, Kernel 5.2 before 05.26.41, Kernel 5.3 before 05.35.41,
  and Kernel 5.4 before 05.42.20. A stack-based buffer overflow leads
  toarbitrary c…
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
vendor: insyde
product: insydeh2o
affected:
  - 'insydeh2o >= 5.0, < 5.08.41'
  - 'insydeh2o >= 5.1, < 5.16.41'
  - 'insydeh2o >= 5.2, < 5.26.41'
  - 'insydeh2o >= 5.3, < 5.35.41'
  - 'insydeh2o >= 5.4, < 5.42.20'
  - simatic_field_pg_m5_firmware
  - simatic_field_pg_m6_firmware
  - simatic_ipc127e_firmware
  - simatic_ipc227g_firmware
  - simatic_ipc277g_firmware
  - simatic_ipc327g_firmware
  - simatic_ipc377g_firmware
  - simatic_ipc427e_firmware
  - simatic_ipc477e_firmware
  - simatic_ipc627e_firmware
  - simatic_ipc647e_firmware
  - simatic_ipc677e_firmware
  - simatic_ipc847e_firmware
  - simatic_itp1000_firmware
patched:
  - insydeh2o 5.42.20
published: '2022-02-03'
updated: '2026-08-11'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-42059'
references:
  - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20220216-0008/'
    label: cve@mitre.org
  - url: 'https://www.insyde.com/security-pledge'
    label: cve@mitre.org
  - url: 'https://www.insyde.com/security-pledge/SA-2022006'
    label: cve@mitre.org
  - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20220216-0008/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.insyde.com/security-pledge'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.insyde.com/security-pledge/SA-2022006'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.kb.cert.org/vuls/id/796611'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-306654.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.00346
epssPercentile: 0.25522
ingestedAt: '2026-08-11T16:47:02.155Z'
---

## Overview

An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41, Kernel 5.1 before 05.16.41, Kernel 5.2 before 05.26.41, Kernel 5.3 before 05.35.41, and Kernel 5.4 before 05.42.20. A stack-based buffer overflow leads toarbitrary code execution in UEFI DisplayTypeDxe DXE driver.

## Affected

- `insydeh2o >= 5.0, < 5.08.41`
- `insydeh2o >= 5.1, < 5.16.41`
- `insydeh2o >= 5.2, < 5.26.41`
- `insydeh2o >= 5.3, < 5.35.41`
- `insydeh2o >= 5.4, < 5.42.20`
- `simatic_field_pg_m5_firmware`
- `simatic_field_pg_m6_firmware`
- `simatic_ipc127e_firmware`
- `simatic_ipc227g_firmware`
- `simatic_ipc277g_firmware`
- `simatic_ipc327g_firmware`
- `simatic_ipc377g_firmware`
- `simatic_ipc427e_firmware`
- `simatic_ipc477e_firmware`
- `simatic_ipc627e_firmware`
- `simatic_ipc647e_firmware`
- `simatic_ipc677e_firmware`
- `simatic_ipc847e_firmware`
- `simatic_itp1000_firmware`

## Remediation

Upgrade past the affected range:

- `insydeh2o 5.42.20`