Insyde InsydeH2O on ARM platforms (HDD password storage in UEFI variables): HDD passwords are recoverable from UEFI

Impact

HDD passwords are recoverable from UEFI variables on affected ARM platforms - insufficiently protected credentials, in CWE terms. The operator concern is drive-level secrets surviving in firmware storage where the next person to hold the box can read them, which matters for any fleet where drive locking is part of the between-tenant wipe story, and for ARM-based nodes appearing in AI inference and edge fleets.

Who can reach it

Requires physical access plus local privilege and user interaction per Insyde's own scoring - so this is a returned-hardware, decommissioning, or colo-access risk rather than a remote one.

What to do

OEM firmware update on Insyde kernel 5.6 / 05.63.21 or 5.7 / 05.72.21. Firmware flash, reboot per node. Advisory dated 2026-08-18, so OEM images are not yet widely available. Operational mitigation that does not wait for the flash: do not rely on ATA HDD passwords as the confidentiality control on affected ARM platforms - use self-encrypting-drive keys or software full-disk encryption with keys held off the node, and cryptographically erase rather than password-lock drives at decommission.

References