CVE-2025-54510: CWE-414 Missing Lock Check in AMD AMD EPYC™ 9004 Series Processors
CVE-2025-54510 is a medium severity vulnerability in AMD EPYC™ 9004 Series Processors involving a missing lock verification in the AMD Secure Processor firmware. This flaw allows a locally authenticated attacker with administrative privileges to alter MMIO routing on some Zen 5-based products, which could compromise guest system integrity. There is no official patch or remediation level currently provided by AMD, and no known exploits are reported in the wild. The vulnerability requires high privileges and local access, limiting its attack surface.
AI Analysis
Technical Summary
This vulnerability (CVE-2025-54510) affects AMD EPYC™ 9004 Series Processors, specifically Zen 5-based products, due to a missing lock check in the AMD Secure Processor (ASP) firmware. The missing lock verification could allow a local attacker with administrative privileges to manipulate memory-mapped I/O (MMIO) routing, potentially impacting the integrity of guest systems running on the affected hardware. The CVSS 4.0 score is 5.9, reflecting medium severity with local attack vector, low attack complexity, and no user interaction required. AMD has not provided an official remediation or patch as of the published date.
Potential Impact
An attacker with local administrative privileges could exploit this vulnerability to alter MMIO routing, potentially compromising the integrity of guest systems on affected AMD EPYC™ 9004 Series Processors. This could lead to unauthorized modifications or interference with system operations at the hardware interface level. However, exploitation requires high privileges and local access, and no known exploits are currently reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by AMD, organizations should monitor AMD advisories for updates. Until a patch is available, restrict administrative access to trusted personnel only to reduce risk.
CVE-2025-54510: CWE-414 Missing Lock Check in AMD AMD EPYC™ 9004 Series Processors
Description
CVE-2025-54510 is a medium severity vulnerability in AMD EPYC™ 9004 Series Processors involving a missing lock verification in the AMD Secure Processor firmware. This flaw allows a locally authenticated attacker with administrative privileges to alter MMIO routing on some Zen 5-based products, which could compromise guest system integrity. There is no official patch or remediation level currently provided by AMD, and no known exploits are reported in the wild. The vulnerability requires high privileges and local access, limiting its attack surface.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2025-54510) affects AMD EPYC™ 9004 Series Processors, specifically Zen 5-based products, due to a missing lock check in the AMD Secure Processor (ASP) firmware. The missing lock verification could allow a local attacker with administrative privileges to manipulate memory-mapped I/O (MMIO) routing, potentially impacting the integrity of guest systems running on the affected hardware. The CVSS 4.0 score is 5.9, reflecting medium severity with local attack vector, low attack complexity, and no user interaction required. AMD has not provided an official remediation or patch as of the published date.
Potential Impact
An attacker with local administrative privileges could exploit this vulnerability to alter MMIO routing, potentially compromising the integrity of guest systems on affected AMD EPYC™ 9004 Series Processors. This could lead to unauthorized modifications or interference with system operations at the hardware interface level. However, exploitation requires high privileges and local access, and no known exploits are currently reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by AMD, organizations should monitor AMD advisories for updates. Until a patch is available, restrict administrative access to trusted personnel only to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMD
- Date Reserved
- 2025-07-23T15:01:50.734Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e135ad82d89c981fbaa767
Added to database: 4/16/2026, 7:17:01 PM
Last enriched: 4/16/2026, 7:32:02 PM
Last updated: 4/16/2026, 9:50:32 PM
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.