High severity · published Sep 12, 2018
CVE-2018-3655
A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Execution Engine Firmware before version…
7.3
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Execution Engine Firmware before version 3.1.55 may allow an unauthenticated user to potentially modify or disclose information via physical access.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Converged Security Management Engine Firmware · Intel
11.0 through 11.8.50; 11.10 through 11.11.50; 11.20 through 11.21.51 · source: NVD
SP
Server Platform Services Firmware · Intel
before 4.0 · source: NVD
TE
Trusted Execution Engine Firmware · Intel
3.0 through 3.1.50 · source: NVD
Affected product
CS
Converged Security Management Engine Firmware
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3655
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-3655
security.netapp.com
https://security.netapp.com/advisory/ntap-20180924-0003/
Patch
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03873en_us
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html
More from Converged Security Management Engine Firmware
9.8
CVE-2019-0153
Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access
8.8
CVE-2019-0169
Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an unauthenticated user…
8.2
CVE-2018-3643
A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55,…
8.2
CVE-2018-3627
Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access
7.8
CVE-2022-29871
Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local…