This vulnerability in AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics arises from a missing authentication mechanism on the KVM key download endpoint. An attacker with knowledge of the endpoint URL can access sensitive cryptographic keys without any authentication, potentially compromising confidentiality. The CVSS 4.0 base score is 6.3, reflecting a network attack vector with low complexity and no privileges required. No official patch or remediation level has been provided by AMD as of the publication date.

The primary impact is the potential loss of confidentiality due to unauthorized retrieval of sensitive keys from the KVM key download endpoint. This could undermine the security of cryptographic operations relying on these keys. There is no indication of privilege escalation, integrity, or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by AMD, monitoring AMD's advisories for updates is recommended. Until a patch is available, restrict access to the affected systems and endpoints to trusted users and networks to reduce exposure. Avoid sharing or exposing the URL of the KVM key download endpoint.