CVE-2023-20576
Received Received - Intake

Insufficient Verification of Data Authenticity in AGESA™

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Advanced Micro Devices Inc.

Description
Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-03
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2023-20576
EUVD
EUVD-2023-60616

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
amd agesa 1.2.0.B
amd agesa 1.0.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2023-20576 is a high-severity vulnerability in AMD processors where insufficient verification of data authenticity in the AGESA firmware allows an attacker to update SPI ROM data. This could lead to denial of service or privilege escalation.

Detection Guidance

Detection involves checking the current firmware version against the required mitigated versions. For Ryzen 3000/5000 desktop processors, verify if ComboAM4v2 1.2.0.B or later is installed. For Athlon mobile processors, check for PicassoPI-FP5 1.0.1.0 or later. Use system tools to inspect firmware versions or consult the motherboard manufacturer's documentation.

Impact Analysis

An attacker could exploit this to cause system crashes (denial of service) or gain elevated privileges (privilege escalation). It affects desktop, mobile, embedded, and some datacenter processors, requiring firmware updates for mitigation.

Compliance Impact

The vulnerability may lead to denial of service or privilege escalation due to insufficient verification of data authenticity in AGESA firmware. This could potentially impact compliance with standards like GDPR or HIPAA by enabling unauthorized access or disruption of systems handling sensitive data.

Mitigation Strategies

Update the AGESA firmware to the specified versions: ComboAM4v2 1.2.0.B for Ryzen 3000/5000 desktop processors or PicassoPI-FP5 1.0.1.0 for Athlon mobile processors. Ensure all other firmware and software are up to date. Follow guidance from AMD or your device manufacturer for the update process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-20576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart