Insyde InsydeH2O on ARM platforms (HDD password storage in UEFI variables): HDD passwords are recoverable from UEFI

CVSS 6.9CVE-2026-8810Firmware, BMC & network fabricINSYDE-SA-2026005curated

Impact

HDD passwords are recoverable from UEFI variables on affected ARM platforms - insufficiently protected credentials, in CWE terms. The operator concern is drive-level secrets surviving in firmware storage where the next person to hold the box can read them, which matters for any fleet where drive locking is part of the between-tenant wipe story, and for ARM-based nodes appearing in AI inference and edge fleets.

Who can reach it

Requires physical access plus local privilege and user interaction per Insyde's own scoring - so this is a returned-hardware, decommissioning, or colo-access risk rather than a remote one.

What to do

OEM firmware update on Insyde kernel 5.6 / 05.63.21 or 5.7 / 05.72.21. Firmware flash, reboot per node. Advisory dated 2026-08-18, so OEM images are not yet widely available. Operational mitigation that does not wait for the flash: do not rely on ATA HDD passwords as the confidentiality control on affected ARM platforms - use self-encrypting-drive keys or software full-disk encryption with keys held off the node, and cryptographically erase rather than password-lock drives at decommission.

References

https://www.insyde.com/security-pledge/SA-2026005/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.