CVE-2018-3658

published 2018-09-12

CVE-2018-3658: Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with Intel AMT provisioned to potentially…

Priority P4 29 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C N I N A L

Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with Intel AMT provisioned to potentially cause a partial denial of service via network access.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
intel	active_management_technology_firmware	< 12.0.5	12.0.5
intel	converged_security_management_engine_firmware	>= 11.0.0 < 12.0.5	12.0.5
intel	manageability_engine_firmware	>= 9.0.0.0 < 11.0	11.0
intel_corporation	intel_active_management_technology	—	—
siemens	simatic_field_pg_m5_firmware	< 22.01.06	22.01.06
siemens	simatic_ipc427e_firmware	< 21.01.09	21.01.09
siemens	simatic_ipc477e_firmware	< 21.01.09	21.01.09
siemens	simatic_ipc547e_firmware	< r1.30.0	r1.30.0
siemens	simatic_ipc627d_firmware	< 19.02.11	19.02.11
siemens	simatic_ipc647d_firmware	< 19.01.14	19.01.14
siemens	simatic_ipc677d_firmware	< 19.02.11	19.02.11
siemens	simatic_ipc827d_firmware	< 19.02.11	19.02.11
siemens	simatic_ipc847d_firmware	< 19.01.14	19.01.14
siemens	simatic_itp1000_firmware	< 23.01.04	23.01.04
siemens	simatic_pc547g_firmware	< r1.23.0	r1.23.0

CVSS provenance

nvd v3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-772