CVE-2018-12147

CWE-20 — Improper Input Validation3 documents3 sources

Severity

6.7MEDIUM

EPSS

0.0%

top 86.28%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Intel Server Platform Services Firmware Intel Converged Security Management Engine Firmware Intel Trusted Execution Engine Firmware

Timeline

PublishedJun 13

Latest updateMay 24

Description

Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages4 packages

▶NVDintel/server_platform_services_firmware< 4.0

▶NVDintel/trusted_execution_engine_firmware3.0 — 3.1.50

▶NVDintel/converged_security_management_engine_firmware11.0 — 11.8.50+2

▶CVEListV5intel(r)_csme_assets_advisorybefore 11.21.55

🔴Vulnerability Details

GHSA

GHSA-4c2g-m3v7-xp4r: Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11↗2022-05-24

▶

CVEList

CVE-2018-12147: Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11↗2019-06-13

▶