AI Threat Alert
CVE-2021-38489
HIGHHDD password plaintext is stored in a UEFI...
Full CISO analysis pending enrichment.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| H2O | pip | — | No patch |
Do you use H2O? You're affected.
How severe is it?
What is the attack surface?
What should I do?
No patch available
Monitor for updates. Consider compensating controls or temporary mitigations.
Which compliance frameworks are affected?
Compliance analysis pending. Sign in for full compliance mapping when available.
Frequently Asked Questions
What is CVE-2021-38489?
HDD password plaintext is stored in a UEFI variable.
Is CVE-2021-38489 actively exploited?
No confirmed active exploitation of CVE-2021-38489 has been reported, but organizations should still patch proactively.
How to fix CVE-2021-38489?
No patch is currently available. Monitor vendor advisories for updates.
What is the CVSS score for CVE-2021-38489?
CVE-2021-38489 has a CVSS v3.1 base score of 8.2 (HIGH).
What are the technical details?
Original Advisory
HDD password plaintext is stored in a UEFI variable.
Weaknesses (CWE)
CWE-256 — Plaintext Storage of a Password: The product stores a password in plaintext within resources such as memory or files.
- [Architecture and Design] Avoid storing passwords in easily accessible locations.
- [Architecture and Design] Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H References
Timeline
Related Vulnerabilities
CVE-2026-65700 9.8 h2oGPT: unauth path traversal in files API leads to RCE
Same package: h2o CVE-2026-6484 8.2 InsydeH2O UEFI: unverified boot allows local code execution
Same package: h2o CVE-2024-10572 7.5 H2O-3: unauthenticated AST parser enables DoS + file write
Same package: h2o CVE-2026-54340 7.5 H2O: HTTP/2 HPACK amplification enables DoS
Same package: h2o CVE-2026-8810 6.9 InsydeH2O: UEFI variable flaw exposes HDD password
Same package: h2o