High severity · published Oct 10, 2018
CVE-2018-12173
Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an unauthenticated…
7.6
CVSS
0.4%
EPSS
No
On KEV
Description
Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an unauthenticated attacker to potentially execute arbitrary code resulting in information disclosure, escalation of privilege and/or denial of service via local access.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Compute Module Hns2600bp Firmware · Intel
before 00.01.0014 · source: NVD
CM
Compute Module Hns2600bpr Firmware · Intel
before 00.01.0014 · source: NVD
SB
Server Board S2600bp Firmware · Intel
before 00.01.0014 · source: NVD
SB
Server Board S2600bpr Firmware · Intel
before 00.01.0014 · source: NVD
SB
Server Board S2600st Firmware · Intel
before 00.01.0014 · source: NVD
SB
Server Board S2600str Firmware · Intel
before 00.01.0014 · source: NVD
SB
Server Board S2600wf Firmware · Intel
before 00.01.0014 · source: NVD
SB
Server Board S2600wfr Firmware · Intel
before 00.01.0014 · source: NVD
SS
Server System H2000g Firmware · Intel
before 00.01.0014 · source: NVD
SS
Server System H2000gr Firmware · Intel
before 00.01.0014 · source: NVD
SS
Server System R1000wf Firmware · Intel
before 00.01.0014 · source: NVD
SS
Server System R1000wfr Firmware · Intel
before 00.01.0014 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-12173
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-12173
support.lenovo.com
http://support.lenovo.com/us/en/solutions/LEN-24799
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00179.html
More from Compute Module Hns2600bp Firmware
8.8
CVE-2020-8732
Heap-based buffer overflow in the firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially…
8.8
CVE-2020-8731
Incorrect execution-assigned permissions in the file system for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user…
8.8
CVE-2020-8730
Heap-based overflow for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of…
8.8
CVE-2020-8718
Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable…
8.8
CVE-2020-8713
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation…