High severity · published May 17, 2019
CVE-2019-0090
Insufficient access control vulnerability in subsystem for Intel(R) CSME before versions 11.x, 12.0.35 Intel(R) TXE 3.x, 4.x, Intel(R) Server Platform Services 3.x, 4.x, Intel(R)…
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
Insufficient access control vulnerability in subsystem for Intel(R) CSME before versions 11.x, 12.0.35 Intel(R) TXE 3.x, 4.x, Intel(R) Server Platform Services 3.x, 4.x, Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Physical
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Converged Security And Management Engine · Intel
before 12.0.35 · source: NVD
SP
Server Platform Services · Intel
before sps_e3_05.00.04.027.0 · source: NVD
Affected product
CS
Converged Security And Management Engine
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0090
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0090
Third Party Advisory
https://support.f5.com/csp/article/K59145983
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html
More from Converged Security And Management Engine
7.8
CVE-2020-8744
Improper initialization in subsystem for Intel(R) CSME versions before12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE versions before 4.0.30 Intel(R) SPS versions…
7.8
CVE-2019-0091
Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to…
6.4
CVE-2020-8755
Race condition in subsystem for Intel(R) CSME versions before 12.0.70 and 14.0.45, Intel(R) SPS versions before E5_04.01.04.400 and E3_05.01.04.200 may allow an unauthenticated…
4.4
CVE-2019-0093
Insufficient data sanitization vulnerability in HECI subsystem for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) SPS before version…