CVE-2025-54504
Last modified
CVE-2025-54504 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker to write to a trusted region used by AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), potentially resulting in loss of integrity.. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker to write to a trusted region used by AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), potentially resulting in loss of integrity.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| AMD | AMD EPYC™ 9005 Series Processors | All versions |
| AMD | AMD EPYC™ Embedded 9005 Series Processors | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2025-54504?
How severe is CVE-2025-54504?
How do I fix CVE-2025-54504?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54499Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fa…3.7
- CVE-2025-5450Improper access control in the certificate management compon…2.7
- CVE-2025-54500An HTTP/2 implementation flaw allows a denial-of-service (Do…5.3
- CVE-2025-54501Improper access control on an internal debug interface could…5.9
- CVE-2025-54502Incorrect use of boot service in the AMD Platform Configurat…7.5
- CVE-2025-54503Improper handling of overlap between protected memory ranges…5.9
- CVE-2025-54505A transient execution vulnerability within AMD CPUs may allo…2
- CVE-2025-54506A time-of-check to time-of-use (TOCTOU) race condition in th…4
- CVE-2025-54507Improper validation of consistency within input in AMD SEV (…5.9
- CVE-2025-54508Improper validation of Reverse Map Table (RMP) entries in th…4
- CVE-2025-54509Improper access control for register interface in the Input-…4
- CVE-2025-5451A stack-based buffer overflow in Ivanti Connect Secure befor…4.9
Are you affected by CVE-2025-54504?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST