Intel Converged Security Management Engine Firmware vulnerabilities
44 known vulnerabilities affecting intel/converged_security_management_engine_firmware.
Total CVEs
44
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH15MEDIUM28
Vulnerabilities
Page 1 of 3
CVE-2019-0153P3CRITICALCVSS 9.8fixed in 12.0.352019-05-17
CVE-2019-0153 [CRITICAL] CWE-119 CVE-2019-0153: Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated us
Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
nvd
CVE-2019-0169P3HIGHCVSS 8.8≥ 11.0, < 11.8.70≥ 11.10, < 11.11.70+2 more2019-12-18
CVE-2019-0169 [HIGH] CWE-787 CVE-2019-0169: Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; In
Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an unauthenticated user to potentially enable escalation of privileges, information disclosure or denial of service via adjacent access.
nvd
CVE-2020-0536P3HIGHCVSS 7.5≥ 11.0, < 11.8.77≥ 11.10, < 11.12.77+4 more2020-06-15
CVE-2020-0536 [HIGH] CWE-20 CVE-2020-0536: Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77,
Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and Intel(R) TXE versions before 3.1.75 and 4.0.25 may allow an unauthenticated user to potentially enable information disclosure via network access.
nvd
CVE-2022-36392P3HIGHCVSS 7.5fixed in 11.12.94fixed in 11.8.94+5 more2023-08-11
CVE-2022-36392 [HIGH] CWE-20 CVE-2022-36392: Improper input validation in some firmware for Intel(R) AMT and Intel(R) Standard Manageability befo
Improper input validation in some firmware for Intel(R) AMT and Intel(R) Standard Manageability before versions 11.8.94, 11.12.94, 11.22.94, 12.0.93, 14.1.70, 15.0.45, and 16.1.27 in Intel (R) CSME may allow an unauthenticated user to potentially enable denial of service via network access.
nvd
CVE-2020-0534P3HIGHCVSS 7.5≥ 12.0, < 12.0.64≥ 13.0, < 13.0.32+2 more2020-06-15
CVE-2020-0534 [HIGH] CWE-20 CVE-2020-0534: Improper input validation in the DAL subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 1
Improper input validation in the DAL subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an unauthenticated user to potentially enable denial of service via network access.
nvd
CVE-2018-3643P3HIGHCVSS 8.2fixed in 12.0.62018-09-12
CVE-2018-3643 [HIGH] CVE-2018-3643: A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged
A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55, 11.21.55, 12.0.6 or Intel(R) Server Platform Services firmware before version 4.x.04 may allow an attacker with administrative privileges to uncover certain platform secrets via local access
nvd
CVE-2018-12208P3HIGHCVSS 7.6≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14
CVE-2018-12208 [HIGH] CWE-119 CVE-2018-12208: Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12
Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel(R) TXE version before 3.1.60 or 4.0.10, or Intel(R) Server Platform Services before version 5.00.04.012 may allow an unauthenticated user to potentially execute arbitrary code via physical access.
nvd
CVE-2018-12191P3HIGHCVSS 7.6≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14
CVE-2018-12191 [HIGH] CWE-119 CVE-2018-12191: Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20
Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before versions 4.00.04.383 or SPS 4.01.02.174, or Intel(R) TXE before versions 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially execute arbitrary code via physical access.
nvd
CVE-2018-3627P3HIGHCVSS 8.2v11.02018-07-10
CVE-2018-3627 [HIGH] CVE-2018-3627: Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitr
Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access.
nvd
CVE-2019-11147P3HIGHCVSS 7.8≥ 11.0, < 11.8.70≥ 11.10, < 11.11.70+4 more2019-12-18
CVE-2019-11147 [HIGH] CVE-2019-11147: Insufficient access control in hardware abstraction driver for MEInfo software for Intel(R) CSME bef
Insufficient access control in hardware abstraction driver for MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0, 14.0.10; TXEInfo software for Intel(R) TXE before versions 3.1.70 and 4.0.20; INTEL-SA-00086 Detection Tool version 1.2.7.0 or before; INTEL-SA-00125 Detection Tool version 1.0.45.0 or before may allow
nvd
CVE-2019-11104P3HIGHCVSS 7.8≥ 11.0, < 11.8.70≥ 11.10, < 11.11.70+4 more2019-12-18
CVE-2019-11104 [HIGH] CWE-20 CVE-2019-11104: Insufficient input validation in MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70
Insufficient input validation in MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access.
nvd
CVE-2019-0086P3HIGHCVSS 7.8≥ 11.0, < 11.8.65≥ 11.10, < 11.11.65+2 more2019-05-17
CVE-2019-0086 [HIGH] CWE-59 CVE-2019-0086: Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME b
Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.
nvd
CVE-2019-11103P3HIGHCVSS 7.8≥ 12.0, < 12.0.45≥ 13.0, < 13.0.10+1 more2019-12-18
CVE-2019-11103 [HIGH] CWE-20 CVE-2019-11103: Insufficient input validation in firmware update software for Intel(R) CSME before versions 12.0.45,
Insufficient input validation in firmware update software for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow an authenticated user to potentially enable escalation of privilege via local access.
nvd
CVE-2020-0542P3HIGHCVSS 7.8≥ 11.0, < 11.8.77≥ 11.10, < 11.12.77+5 more2020-06-15
CVE-2020-0542 [HIGH] CVE-2020-0542: Improper buffer restrictions in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.3
Improper buffer restrictions in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an authenticated user to potentially enable escalation of privilege, information disclosure or denial of service via local access.
nvd
CVE-2022-29871P4HIGHCVSS 7.8fixed in 11.12.94fixed in 11.8.94+11 more2023-08-11
CVE-2022-29871 [HIGH] CWE-284 CVE-2022-29871: Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow
Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
nvd
CVE-2018-3655P4HIGHCVSS 7.3≥ 11.0, ≤ 11.8.50≥ 11.10, ≤ 11.11.50+1 more2018-09-12
CVE-2018-3655 [HIGH] CVE-2018-3655: A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services
A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Execution Engine Firmware before version 3.1.55 may allow an unauthenticated user to potentially modify or disclose information via physical access.
nvd
CVE-2018-12196P4MEDIUMCVSS 6.7≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14
CVE-2018-12196 [MEDIUM] CWE-20 CVE-2018-12196: Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.
Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow a privileged user to potentially execute arbitrary code via local access.
nvd
CVE-2018-3616P4MEDIUMCVSS 5.9≥ 11.0.0, < 12.0.52018-09-12
CVE-2018-3616 [MEDIUM] CVE-2018-3616: Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Tec
Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain the TLS session key via the network.
nvd
CVE-2018-12185P4MEDIUMCVSS 6.8≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14
CVE-2018-12185 [MEDIUM] CWE-20 CVE-2018-12185: Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.
Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow an unauthenticated user to potentially execute arbitrary code via physical access.
nvd
CVE-2018-3657P4MEDIUMCVSS 6.7≥ 11.0.0, < 12.0.52018-09-12
CVE-2018-3657 [MEDIUM] CWE-119 CVE-2018-3657: Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may all
Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may allow a privileged user to potentially execute arbitrary code with Intel AMT execution privilege via local access.
nvd
1 / 3Next →