High severity · published Mar 12, 2020
CVE-2020-0530
Improper buffer restrictions in firmware for Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via local access
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Improper buffer restrictions in firmware for Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via local access. The list of affected products is provided in intel-sa-00343: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00343.html
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Compute Stick Stk1a32sc Firmware · Intel
sc0045 · source: NVD
CS
Compute Stick Stk1aw32sc Firmware · Intel
sc0045 · source: NVD
CS
Compute Stick Stk2m364cc Firmware · Intel
ccsklm30.86a.0062 · source: NVD
CS
Compute Stick Stk2m3w64cc Firmware · Intel
ccsklm30.86a.0062 · source: NVD
N7
Nuc 7 Enthusiast PC Nuc7i7bnhxg Firmware · Intel
bnkbl357.86a.0081 · source: NVD
N7
Nuc 7 Essential PC Nuc7cjysal Firmware · Intel
jyglkcpx.86a.0053 · source: NVD
N7
Nuc 7 Home A Mini PC Nuc7i3bnhxf Firmware · Intel
bnkbl357.86a.0081 · source: NVD
N7
Nuc 7 Home A Mini PC Nuc7i5bnhxf Firmware · Intel
bnkbl357.86a.0081 · source: NVD
N7
Nuc 7 Home A Mini PC Nuc7i5bnkp Firmware · Intel
bnkbl357.86a.0081 · source: NVD
N8
Nuc 8 Business PC Nuc8i7hnkqc Firmware · Intel
hnkbli70.86a.0059 · source: NVD
N8
Nuc 8 Enthusiast PC Nuc8i7bekqa Firmware · Intel
becfl357.86a.0077 · source: NVD
N8
Nuc 8 Home PC Nuc8i3cysm Firmware · Intel
cycnli35.86a.0044 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-0530
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-0530
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00343.html
More from Compute Stick Stk1a32sc Firmware
7.8
CVE-2021-0109
Insecure inherited permissions for the Intel(R) SOC driver package for STK1A32SC before version 604 may allow an authenticated user to potentially enable escalation of privilege…
6.7
CVE-2020-0526
Improper input validation in firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege via local access