Intel Converged Security Management Engine Firmware vulnerabilities
44 known vulnerabilities affecting intel/converged_security_management_engine_firmware.
Total CVEs
44
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH15MEDIUM28
Vulnerabilities
Page 2 of 3
CVE-2018-3658P4MEDIUMCVSS 5.3≥ 11.0.0, < 12.0.52018-09-12
CVE-2018-3658 [MEDIUM] CWE-772 CVE-2018-3658: Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauth
Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with Intel AMT provisioned to potentially cause a partial denial of service via network access.
nvd
CVE-2018-12192P4MEDIUMCVSS 6.8≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14
CVE-2018-12192 [MEDIUM] CWE-287 CVE-2018-12192: Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, o
Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_04.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access.
nvd
CVE-2020-0541P4MEDIUMCVSS 6.7≥ 12.0, < 12.0.64≥ 13.0, < 13.0.32+2 more2020-06-15
CVE-2020-0541 [MEDIUM] CWE-787 CVE-2020-0541: Out-of-bounds write in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.
Out-of-bounds write in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow a privileged user to potentially enable escalation of privilege via local access.
nvd
CVE-2019-11110P4MEDIUMCVSS 6.7≥ 11.0, < 11.8.70≥ 11.10, < 11.11.70+4 more2019-12-18
CVE-2019-11110 [MEDIUM] CVE-2019-11110: Authentication bypass in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70
Authentication bypass in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege via local access.
nvd
CVE-2019-0098P4MEDIUMCVSS 6.8≥ 11.0, < 11.8.65≥ 11.10, < 11.11.65+2 more2019-05-17
CVE-2019-0098 [MEDIUM] CVE-2019-0098: Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3
Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
nvd
CVE-2019-14598P4MEDIUMCVSS 6.7≥ 12.0, < 12.0.48≥ 12.0, < 12.0.56+2 more2020-02-13
CVE-2019-14598 [MEDIUM] CWE-287 CVE-2019-14598: Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.
Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
nvd
CVE-2019-11105P4MEDIUMCVSS 6.7≥ 12.0, < 12.0.45≥ 13.0, < 13.0.10+1 more2019-12-18
CVE-2019-11105 [MEDIUM] CVE-2019-11105: Logic issue in subsystem for Intel(R) CSME before versions 12.0.45, 13.0.10 and 14.0.10 may allow a
Logic issue in subsystem for Intel(R) CSME before versions 12.0.45, 13.0.10 and 14.0.10 may allow a privileged user to potentially enable escalation of privilege and information disclosure via local access.
nvd
CVE-2018-12190P4MEDIUMCVSS 6.7≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14
CVE-2018-12190 [MEDIUM] CWE-20 CVE-2018-12190: Insufficient input validation in Intel(r) CSME subsystem before versions 11.8.60, 11.11.60, 11.22.60
Insufficient input validation in Intel(r) CSME subsystem before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel(r) TXE before 3.1.60 or 4.0.10 may allow a privileged user to potentially enable an escalation of privilege via local access.
nvd
CVE-2019-11087P4MEDIUMCVSS 6.7≥ 11.0, < 11.8.70≥ 11.10, < 11.11.70+4 more2019-12-18
CVE-2019-11087 [MEDIUM] CWE-20 CVE-2019-11087: Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70,
Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege, information disclosure or denial of service via local access.
nvd
CVE-2019-11106P4MEDIUMCVSS 6.7≥ 11.0, < 11.8.70≥ 12.0, < 12.0.45+2 more2019-12-18
CVE-2019-11106 [MEDIUM] CWE-613 CVE-2019-11106: Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45,
Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege via local access.
nvd
CVE-2018-12199P4MEDIUMCVSS 6.2≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14
CVE-2018-12199 [MEDIUM] CWE-119 CVE-2018-12199: Buffer overflow in an OS component in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0
Buffer overflow in an OS component in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel TXE version before 3.1.60 or 4.0.10 may allow a privileged user to potentially execute arbitrary code via physical access.
nvd
CVE-2018-12147P4MEDIUMCVSS 6.7≥ 11.0, ≤ 11.8.50≥ 11.10, ≤ 11.11.50+1 more2019-06-13
CVE-2018-12147 [MEDIUM] CWE-20 CVE-2018-12147: Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Ser
Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access.
nvd
CVE-2019-0170P4MEDIUMCVSS 6.7fixed in 12.0.352019-05-17
CVE-2019-0170 [MEDIUM] CWE-119 CVE-2019-0170: Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to p
Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to potentially enable escalation of privilege via local access.
nvd
CVE-2019-11108P4MEDIUMCVSS 6.7≥ 12.0, < 12.0.45≥ 13.0, < 13.0.102019-12-18
CVE-2019-11108 [MEDIUM] CWE-20 CVE-2019-11108: Insufficient input validation in subsystem for Intel(R) CSME before versions 12.0.45 and 13.0.10 may
Insufficient input validation in subsystem for Intel(R) CSME before versions 12.0.45 and 13.0.10 may allow a privileged user to potentially enable escalation of privilege via local access.
nvd
CVE-2020-0533P4MEDIUMCVSS 6.7≥ 11.0, < 11.8.77≥ 11.10, < 11.12.77+1 more2020-06-15
CVE-2020-0533 [MEDIUM] CWE-326 CVE-2020-0533: Reversible one-way hash in Intel(R) CSME versions before 11.8.76, 11.12.77 and 11.22.77 may allow a
Reversible one-way hash in Intel(R) CSME versions before 11.8.76, 11.12.77 and 11.22.77 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
nvd
CVE-2018-3659P4MEDIUMCVSS 6.8fixed in 12.0.52018-09-12
CVE-2018-3659 [MEDIUM] CVE-2018-3659: A vulnerability in Intel PTT module in Intel CSME firmware before version 12.0.5 and Intel TXE firmw
A vulnerability in Intel PTT module in Intel CSME firmware before version 12.0.5 and Intel TXE firmware before version 4.0 may allow an unauthenticated user to potentially disclose information via physical access.
nvd
CVE-2020-0539P4MEDIUMCVSS 5.5≥ 11.0, < 11.8.77≥ 11.10, < 11.12.77+4 more2020-06-15
CVE-2020-0539 [MEDIUM] CWE-22 CVE-2020-0539: Path traversal in subsystem for Intel(R) DAL software for Intel(R) CSME versions before 11.8.77, 11.
Path traversal in subsystem for Intel(R) DAL software for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33 and Intel(R) TXE versions before 3.1.75, 4.0.25 may allow an unprivileged user to potentially enable denial of service via local access.
nvd
CVE-2018-12188P4MEDIUMCVSS 4.6≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14
CVE-2018-12188 [MEDIUM] CWE-20 CVE-2018-12188: Insufficient input validation in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 o
Insufficient input validation in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel TXE before version 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially modify data via physical access.
nvd
CVE-2019-11101P4MEDIUMCVSS 4.4≥ 11.0, < 11.8.70≥ 11.10, < 11.11.70+4 more2019-12-18
CVE-2019-11101 [MEDIUM] CWE-20 CVE-2019-11101: Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70,
Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable information disclosure via local access.
nvd
CVE-2019-0168P4MEDIUMCVSS 4.4≥ 11.0, < 11.8.70≥ 12.0, < 12.0.45+1 more2019-12-18
CVE-2019-0168 [MEDIUM] CWE-20 CVE-2019-0168: Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45 an
Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45 and 13.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable information disclosure via local access.
nvd