CVE-2020-8703
published 2021-06-09CVE-2020-8703: Improper buffer restrictions in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and…
PriorityP428medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
EPSS
0.35%
27.1th percentile
Improper buffer restrictions in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and 15.0.22 may allow a privileged user to potentially enable escalation of privilege via local access.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| intel | converged_security_and_manageability_engine | < 12.0.81 | 12.0.81 |
| intel | converged_security_and_manageability_engine | < 13.0.47 | 13.0.47 |
| intel | converged_security_and_manageability_engine | < 13.30.17 | 13.30.17 |
| intel | converged_security_and_manageability_engine | < 14.1.53 | 14.1.53 |
| intel | converged_security_and_manageability_engine | < 14.5.32 | 14.5.32 |
| intel | converged_security_and_manageability_engine | < 11.8.86 | 11.8.86 |
| intel | converged_security_and_manageability_engine | < 11.12.86 | 11.12.86 |
| intel | converged_security_and_manageability_engine | < 11.22.86 | 11.22.86 |
| intel | converged_security_and_manageability_engine | < 15.0.22 | 15.0.22 |
| siemens | simatic_ipc627e_firmware | < 25.02.10 | 25.02.10 |
| siemens | simatic_ipc647e_firmware | < 25.02.10 | 25.02.10 |
| siemens | simatic_ipc677e_firmware | < 25.02.10 | 25.02.10 |
| siemens | simatic_ipc847e_firmware | < 25.02.10 | 25.02.10 |
CVSS provenance
nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens Industrial Products Intel CPUs (Update G)
cisa_ics·2022-09-13
Siemens Industrial Products Intel CPUs (Update G)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens Industrial Products Intel CPUs (Update G)
Last RevisedDecember 15, 2022
Alert CodeICSA-21-222-05
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC, SINUMERIK
- Vulnerabilities: Missing Encryption of Sensitive Data
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSA-21-222-05 Siemens Industrial Products Intel CPU (Update F) that was published September 13, 2022, to the ICS webpage on www.cisa.gov/ics.
## 3. RISK EVALUATION
Successful exploitation of these vul
GHSA
GHSA-vqjv-932p-6v65: Improper buffer restrictions in a subsystem in the Intel(R) CSME versions before 11
ghsa_unreviewed·2022-05-24
CVE-2020-8703 [MEDIUM] CWE-119 GHSA-vqjv-932p-6v65: Improper buffer restrictions in a subsystem in the Intel(R) CSME versions before 11
Improper buffer restrictions in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and 15.0.22 may allow a privileged user to potentially enable escalation of privilege via local access.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdfhttps://security.netapp.com/advisory/ntap-20210611-0004/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.htmlhttps://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdfhttps://security.netapp.com/advisory/ntap-20210611-0004/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html
2021-06-09
Published