CVE-2020-24506
published 2021-06-09CVE-2020-24506: Out of bound read in a subsystem in the Intel(R) CSME versions before 12.0.81, 13.0.47, 13.30.17, 14.1.53 and 14.5.32 may allow a privileged user to…
PriorityP415medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.28%
20.6th percentile
Out of bound read in a subsystem in the Intel(R) CSME versions before 12.0.81, 13.0.47, 13.30.17, 14.1.53 and 14.5.32 may allow a privileged user to potentially enable information disclosure via local access.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| intel | converged_security_and_manageability_engine | < 12.0.81 | 12.0.81 |
| intel | converged_security_and_manageability_engine | < 13.0.47 | 13.0.47 |
| intel | converged_security_and_manageability_engine | < 13.30.17 | 13.30.17 |
| intel | converged_security_and_manageability_engine | < 14.1.53 | 14.1.53 |
| intel | converged_security_and_manageability_engine | < 14.5.32 | 14.5.32 |
| siemens | simatic_ipc627e_firmware | < 25.02.10 | 25.02.10 |
| siemens | simatic_ipc647e_firmware | < 25.02.10 | 25.02.10 |
| siemens | simatic_ipc677e_firmware | < 25.02.10 | 25.02.10 |
| siemens | simatic_ipc847e_firmware | < 25.02.10 | 25.02.10 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens Industrial Products Intel CPUs (Update G)
cisa_ics·2022-09-13
Siemens Industrial Products Intel CPUs (Update G)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens Industrial Products Intel CPUs (Update G)
Last RevisedDecember 15, 2022
Alert CodeICSA-21-222-05
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC, SINUMERIK
- Vulnerabilities: Missing Encryption of Sensitive Data
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSA-21-222-05 Siemens Industrial Products Intel CPU (Update F) that was published September 13, 2022, to the ICS webpage on www.cisa.gov/ics.
## 3. RISK EVALUATION
Successful exploitation of these vul
GHSA
GHSA-q3wq-vgfp-h826: Out of bound read in a subsystem in the Intel(R) CSME versions before 12
ghsa_unreviewed·2022-05-24
CVE-2020-24506 [MEDIUM] CWE-125 GHSA-q3wq-vgfp-h826: Out of bound read in a subsystem in the Intel(R) CSME versions before 12
Out of bound read in a subsystem in the Intel(R) CSME versions before 12.0.81, 13.0.47, 13.30.17, 14.1.53 and 14.5.32 may allow a privileged user to potentially enable information disclosure via local access.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdfhttps://security.netapp.com/advisory/ntap-20210611-0004/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.htmlhttps://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdfhttps://security.netapp.com/advisory/ntap-20210611-0004/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html
2021-06-09
Published