High severity · published Dec 18, 2019
CVE-2019-11103
Insufficient input validation in firmware update software for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow an authenticated user to potentially enable…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Insufficient input validation in firmware update software for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Converged Security Management Engine Firmware · Intel
12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10 · source: NVD
Affected product
CS
Converged Security Management Engine Firmware
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11103
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11103
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html
More from Converged Security Management Engine Firmware
9.8
CVE-2019-0153
Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access
8.8
CVE-2019-0169
Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an unauthenticated user…
8.2
CVE-2018-3643
A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55,…
8.2
CVE-2018-3627
Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access
7.8
CVE-2022-29871
Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local…