High severity · published May 17, 2019
CVE-2019-0091
Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to…
7.8
CVSS
0.5%
EPSS
No
On KEV
Description
Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Converged Security And Management Engine · Intel
11.8.0 before 11.8.65; 11.11.0 before 11.11.65; 11.22.0 before 11.22.65; 12.0 before 12.0.35 · source: NVD
TE
Trusted Execution Technology · Intel
3.1.0 before 3.1.65; 4.0 before 4.0.15 · source: NVD
Affected product
CS
Converged Security And Management Engine
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0091
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0091
support.f5.com
https://support.f5.com/csp/article/K21423526
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html
More from Converged Security And Management Engine
7.8
CVE-2020-8744
Improper initialization in subsystem for Intel(R) CSME versions before12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE versions before 4.0.30 Intel(R) SPS versions…
7.1
CVE-2019-0090
Insufficient access control vulnerability in subsystem for Intel(R) CSME before versions 11.x, 12.0.35 Intel(R) TXE 3.x, 4.x, Intel(R) Server Platform Services 3.x, 4.x, Intel(R)…
6.4
CVE-2020-8755
Race condition in subsystem for Intel(R) CSME versions before 12.0.70 and 14.0.45, Intel(R) SPS versions before E5_04.01.04.400 and E3_05.01.04.200 may allow an unauthenticated…
4.4
CVE-2019-0093
Insufficient data sanitization vulnerability in HECI subsystem for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) SPS before version…