CVE-2020-24525
published 2020-11-12CVE-2020-24525: Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via…
PriorityP334high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.29%
20.7th percentile
Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| intel | nuc_8_mainstream-g_kit_nuc8i5inh_firmware | — | — |
| intel | nuc_8_mainstream-g_kit_nuc8i7inh_firmware | — | — |
| intel | nuc_8_mainstream-g_mini_pc_nuc8i5inh_firmware | — | — |
| intel | nuc_8_mainstream-g_mini_pc_nuc8i7inh_firmware | — | — |
| intel | nuc_8_pro_board_nuc8i3pnb_firmware | — | — |
| intel | nuc_8_pro_kit_nuc8i3pnh_firmware | — | — |
| intel | nuc_8_pro_kit_nuc8i3pnk_firmware | — | — |
| intel | nuc_8_pro_mini_pc_nuc8i3pnk_firmware | — | — |
| intel | nuc_8_rugged_kit_nuc8cchkr_firmware | — | — |
| intel | nuc_9_pro_kit_nuc9v7qnx_firmware | — | — |
| intel | nuc_9_pro_kit_nuc9vxqnx_firmware | — | — |
| intel | nuc_board_h27002-400_firmware | — | — |
| intel | nuc_board_h27002-401_firmware | — | — |
| intel | nuc_board_h27002-402_firmware | — | — |
| intel | nuc_board_h27002-404_firmware | — | — |
| intel | nuc_board_h27002-500_firmware | — | — |
| intel | nuc_board_nuc8cchb_firmware | — | — |
| intel | nuc_kit_h26998-401_firmware | — | — |
| intel | nuc_kit_h26998-402_firmware | — | — |
| intel | nuc_kit_h26998-403_firmware | — | — |
| intel | nuc_kit_h26998-404_firmware | — | — |
| intel | nuc_kit_h26998-405_firmware | — | — |
| intel | nuc_kit_h26998-500_firmware | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-11-12
Published