Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://infosec.exchange/users/harrysintonen/statuses/116024183557830755">Harry Sintonen (harrysintonen@infosec.exchange)'s status on Saturday, 07-Feb-2026 00:26:18 JST</a><a href="https://infosec.exchange/@harrysintonen" title="harrysintonen@infosec.exchange"><img src="https://gnusocial.jp/avatar/185551-48-20250911120558.webp" width="48" height="48" alt="Harry Sintonen" style="position: absolute; left: 0; top: 0;">Harry Sintonen</a></section><article><p>Apparently AMD's AutoUpdate downloads the updates over HTTP and executes them without any validation (presumably as SYSTEM  user). AMD was notified of the vulnerability but according to them "attack requiring physical access to victim's computer/device, man in the middle or compromised user accounts" are out of scope.</p><p>Madness.</p><p>source: <a href="https://mrbruh.com/amd/" rel="nofollow">https://mrbruh.com/amd/</a></p><p><a href="https://infosec.exchange/tags/vulnerability" rel="tag">#vulnerability</a> <a href="https://infosec.exchange/tags/infosec" rel="tag">#infosec</a> <a href="https://infosec.exchange/tags/cybersecurity" rel="tag">#cybersecurity</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/6129327#notice-12071332">In conversation</a><time datetime="2026-02-07T00:26:18+09:00" title="Saturday, 07-Feb-2026 00:26:18 JST">about 6 months ago</time> <span>from <span><a href="https://infosec.exchange/@harrysintonen/116024183557830755" rel="external" title="Sent from infosec.exchange via ActivityPub">infosec.exchange</a></span></span><a href="https://infosec.exchange/@harrysintonen/116024183557830755">permalink</a><h4>Attachments</h4><ol><li><article><header><div>No result found on File_thumbnail lookup.</div><h5><a href="https://mrbruh.com/amd/#vulnerability">The RCE that AMD won't fix!</a></h5><div></div></header><div>After reporting a RCE in AMD's auto-update software, they decided to not patch it due to it requiring a man-in-the-middle attack to perform.</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Harry Sintonen (harrysintonen@infosec.exchange)'s status on Saturday, 07-Feb-2026 00:26:18 JST Harry Sintonen
Apparently AMD's AutoUpdate downloads the updates over HTTP and executes them without any validation (presumably as SYSTEM user). AMD was notified of the vulnerability but according to them "attack requiring physical access to victim's computer/device, man in the middle or compromised user accounts" are out of scope.
Madness.
source: https://mrbruh.com/amd/
#vulnerability #infosec #cybersecurity
In conversationabout 6 months ago from infosec.exchangepermalink
Attachments
1. No result found on File_thumbnail lookup.
  The RCE that AMD won't fix!
  After reporting a RCE in AMD's auto-update software, they decided to not patch it due to it requiring a man-in-the-middle attack to perform.

Public

Embed Notice

HTML Code

Corresponding Notice