Intel Converged Security Management Engine Firmware vulnerabilities

44 known vulnerabilities affecting intel/converged_security_management_engine_firmware.

Total CVEs

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

CRITICAL1HIGH15MEDIUM28

Vulnerabilities

Page 2 of 3

CVE-2019-11106MEDIUMCVSS 6.7≥ 11.0, < 11.8.70≥ 12.0, < 12.0.45+2 more2019-12-18

CVE-2019-11106 [MEDIUM] CWE-613 CVE-2019-11106: Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege via local access.

nvd

CVE-2019-11105MEDIUMCVSS 6.7≥ 12.0, < 12.0.45≥ 13.0, < 13.0.10+1 more2019-12-18

CVE-2019-11105 [MEDIUM] CVE-2019-11105: Logic issue in subsystem for Intel(R) CSME before versions 12.0.45, 13.0.10 and 14.0.10 may allow a Logic issue in subsystem for Intel(R) CSME before versions 12.0.45, 13.0.10 and 14.0.10 may allow a privileged user to potentially enable escalation of privilege and information disclosure via local access.

nvd

CVE-2019-0165MEDIUMCVSS 4.4≥ 12.0, < 12.0.45≥ 13.0, < 13.0.10+1 more2019-12-18

CVE-2019-0165 [MEDIUM] CWE-20 CVE-2019-0165: Insufficient Input validation in the subsystem for Intel(R) CSME before versions 12.0.45,13.0.10 and Insufficient Input validation in the subsystem for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow a privileged user to potentially enable denial of service via local access.

nvd

CVE-2018-12147MEDIUMCVSS 6.7≥ 11.0, ≤ 11.8.50≥ 11.10, ≤ 11.11.50+1 more2019-06-13

CVE-2018-12147 [MEDIUM] CWE-20 CVE-2018-12147: Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Ser Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access.

nvd

CVE-2019-0153CRITICALCVSS 9.8fixed in 12.0.352019-05-17

CVE-2019-0153 [CRITICAL] CWE-119 CVE-2019-0153: Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated us Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access.

nvd

CVE-2019-0086HIGHCVSS 7.8≥ 11.0, < 11.8.65≥ 11.10, < 11.11.65+2 more2019-05-17

CVE-2019-0086 [HIGH] CWE-59 CVE-2019-0086: Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME b Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.

nvd

CVE-2019-0098MEDIUMCVSS 6.8≥ 11.0, < 11.8.65≥ 11.10, < 11.11.65+2 more2019-05-17

CVE-2019-0098 [MEDIUM] CVE-2019-0098: Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3 Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

nvd

CVE-2019-0170MEDIUMCVSS 6.7fixed in 12.0.352019-05-17

CVE-2019-0170 [MEDIUM] CWE-119 CVE-2019-0170: Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to p Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to potentially enable escalation of privilege via local access.

nvd

CVE-2018-12191HIGHCVSS 7.6≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14

CVE-2018-12191 [HIGH] CWE-119 CVE-2018-12191: Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before versions 4.00.04.383 or SPS 4.01.02.174, or Intel(R) TXE before versions 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially execute arbitrary code via physical access.

nvd

CVE-2018-12208HIGHCVSS 7.6≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14

CVE-2018-12208 [HIGH] CWE-119 CVE-2018-12208: Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12 Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel(R) TXE version before 3.1.60 or 4.0.10, or Intel(R) Server Platform Services before version 5.00.04.012 may allow an unauthenticated user to potentially execute arbitrary code via physical access.

nvd

CVE-2018-12196MEDIUMCVSS 6.7≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14

CVE-2018-12196 [MEDIUM] CWE-20 CVE-2018-12196: Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11. Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow a privileged user to potentially execute arbitrary code via local access.

nvd

CVE-2018-12199MEDIUMCVSS 6.2≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14

CVE-2018-12199 [MEDIUM] CWE-119 CVE-2018-12199: Buffer overflow in an OS component in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0 Buffer overflow in an OS component in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel TXE version before 3.1.60 or 4.0.10 may allow a privileged user to potentially execute arbitrary code via physical access.

nvd

CVE-2018-12190MEDIUMCVSS 6.7≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14

CVE-2018-12190 [MEDIUM] CWE-20 CVE-2018-12190: Insufficient input validation in Intel(r) CSME subsystem before versions 11.8.60, 11.11.60, 11.22.60 Insufficient input validation in Intel(r) CSME subsystem before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel(r) TXE before 3.1.60 or 4.0.10 may allow a privileged user to potentially enable an escalation of privilege via local access.

nvd

CVE-2018-12185MEDIUMCVSS 6.8≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14

CVE-2018-12185 [MEDIUM] CWE-20 CVE-2018-12185: Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11. Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow an unauthenticated user to potentially execute arbitrary code via physical access.

nvd

CVE-2018-12188MEDIUMCVSS 4.6≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14

CVE-2018-12188 [MEDIUM] CWE-20 CVE-2018-12188: Insufficient input validation in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 o Insufficient input validation in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel TXE before version 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially modify data via physical access.

nvd

CVE-2018-12189MEDIUMCVSS 4.4≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14

CVE-2018-12189 [MEDIUM] CWE-754 CVE-2018-12189: Unhandled exception in Content Protection subsystem in Intel CSME before versions 11.8.60, 11.11.60, Unhandled exception in Content Protection subsystem in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel TXE before 3.1.60 or 4.0.10 may allow privileged user to potentially modify data via local access.

nvd

CVE-2018-12192MEDIUMCVSS 6.8≥ 11.0, < 11.8.60≥ 11.10, < 11.11.60+2 more2019-03-14

CVE-2018-12192 [MEDIUM] CWE-287 CVE-2018-12192: Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, o Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_04.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access.

nvd

CVE-2018-3643HIGHCVSS 8.2fixed in 12.0.62018-09-12

CVE-2018-3643 [HIGH] CVE-2018-3643: A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55, 11.21.55, 12.0.6 or Intel(R) Server Platform Services firmware before version 4.x.04 may allow an attacker with administrative privileges to uncover certain platform secrets via local access

nvd

CVE-2018-3655HIGHCVSS 7.3≥ 11.0, ≤ 11.8.50≥ 11.10, ≤ 11.11.50+1 more2018-09-12

CVE-2018-3655 [HIGH] CVE-2018-3655: A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Execution Engine Firmware before version 3.1.55 may allow an unauthenticated user to potentially modify or disclose information via physical access.

nvd

CVE-2018-3659MEDIUMCVSS 6.8fixed in 12.0.52018-09-12

CVE-2018-3659 [MEDIUM] CVE-2018-3659: A vulnerability in Intel PTT module in Intel CSME firmware before version 12.0.5 and Intel TXE firmw A vulnerability in Intel PTT module in Intel CSME firmware before version 12.0.5 and Intel TXE firmware before version 4.0 may allow an unauthenticated user to potentially disclose information via physical access.

nvd

← Previous2 / 3Next →