How severe is CVE-2021-0155?

CVE-2021-0155 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2021-0155 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-0155?

CVE-2021-0155 primarily affects Intel Xeon E7-8894 V4 Firmware. In total, 173 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-0155?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-0155 published?

CVE-2021-0155 was published on 2022-05-12 and last updated on 2026-06-17.

CVE-2021-0155

CVE-2021-0155 is a medium-severity vulnerability in Intel Xeon E7-8894 V4 Firmware with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-252.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 2.1
EPSS exploit prediction: 0% (17th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-252
Affected product: Intel Xeon E7-8894 V4 Firmware
Published: 2022-05-12
Last modified: 2026-06-17

Description

Unchecked return value in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

Frequently asked questions

What is CVE-2021-0155?: Unchecked return value in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
How severe is CVE-2021-0155?: CVE-2021-0155 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2021-0155 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-0155?: CVE-2021-0155 primarily affects Intel Xeon E7-8894 V4 Firmware. In total, 173 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-0155?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-0155 published?: CVE-2021-0155 was published on 2022-05-12 and last updated on 2026-06-17.

References

Affected products (173)

cpe:2.3:o:intel:xeon_e7-8894_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_e7-4809_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_e7-4820_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_e7-4830_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_e7-4850_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_e7-8860_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_e7-8867_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_e7-8870_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_e7-8880_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_e7-8890_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_e7-8891_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_e7-8893_v4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1702_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1712tr_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1713nt_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1713nte_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1714_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1715ter_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1718t_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1722ne_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1726_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1732te_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1733nt_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1734nt_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1735tr_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1736_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1736nt_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1739_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1746ter_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1747nte_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1748te_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-1749nt_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-2712t_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-2733nt_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-2738_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-2752nte_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-2752ter_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-2753nt_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-2766nt_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:xeon_d-2775te_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Intel Xeon E7-8894 V4 Firmware

CVE-2019-11137 — High (CVSS 8.2): Insufficient input validation in system firmware for Intel(R) Xeon(R) Scalable Processors, Intel(R) Xeon(R) Processors…
CVE-2021-33123 — High (CVSS 7.8): Improper access control in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user…
CVE-2021-0189 — High (CVSS 7.8): Use of out-of-range pointer offset in the BIOS firmware for some Intel(R) Processors may allow a privileged user to…
CVE-2021-0154 — High (CVSS 7.8): Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially…
CVE-2021-33124 — Medium (CVSS 6.7): Out-of-bounds write in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to…
CVE-2019-0151 — Medium (CVSS 6.7): Insufficient memory protection in Intel(R) TXT for certain Intel(R) Core Processors and Intel(R) Xeon(R) Processors may…

All CVEs affecting Intel Xeon E7-8894 V4 Firmware →

Other CWE-252 vulnerabilities

CVE-2025-66565 — Critical (CVSS 9.8): Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's…
CVE-2021-38171 — Critical (CVSS 9.8): adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a…
CVE-2021-26955 — Critical (CVSS 9.8): An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because…
CVE-1999-0199 — Critical (CVSS 9.8): manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return…
CVE-2019-15900 — Critical (CVSS 9.8): An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without…
CVE-2010-0211 — Critical (CVSS 9.8): The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the…

Browse all CWE-252 vulnerabilities →