High severity · published Sep 12, 2018
CVE-2018-3643
A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55,…
8.2
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55, 11.21.55, 12.0.6 or Intel(R) Server Platform Services firmware before version 4.x.04 may allow an attacker with administrative privileges to uncover certain platform secrets via local access or to potentially execute arbitrary code.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Converged Security Management Engine Firmware · Intel
before 12.0.6 · source: NVD
SP
Server Platform Services Firmware · Intel
before 4.00.04 · source: NVD
Affected product
CS
Converged Security Management Engine Firmware
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3643
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-3643
Third Party Advisory
https://security.netapp.com/advisory/ntap-20180924-0002/
Patch
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03873en_us
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00131.html
More from Converged Security Management Engine Firmware
9.8
CVE-2019-0153
Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access
8.8
CVE-2019-0169
Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an unauthenticated user…
8.2
CVE-2018-3627
Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access
7.8
CVE-2022-29871
Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local…
7.8
CVE-2020-0542
Improper buffer restrictions in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an authenticated user to potentially enable escalation…