Medium severity · published Jun 15, 2020
CVE-2020-0545
Integer overflow in subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77 and Intel(R) TXE versions before 3.1.75, 4.0.25 and Intel(R) Server Platform Services…
4.4
CVSS
0.4%
EPSS
No
On KEV
Description
Integer overflow in subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77 and Intel(R) TXE versions before 3.1.75, 4.0.25 and Intel(R) Server Platform Services (SPS) versions before SPS_E5_04.01.04.380.0, SPS_SoC-X_04.00.04.128.0, SPS_SoC-A_04.00.04.211.0, SPS_E3_04.01.04.109.0, SPS_E3_04.08.04.070.0 may allow a privileged user to potentially enable denial of service via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Converged Security Management Engine Firmware · Intel
11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77 · source: NVD
SP
Server Platform Services · Intel
sps_e3_04.00.00.000.0 before sps_e3_04.01.04.109.0; sps_e3_04.08.00.000.0 before sps_e3_04.08.04.070.0; sps_e5_04.00.00.000.0 before sps_e5_04.01.04.380.0; sps_soc-a_04.00.00.000.0 before sps_soc-a_04.00.04.211.0; sps_soc-x_04.00.00.000.0 before sps_soc-x_04.00.04.128.0 · source: NVD
TE
Trusted Execution Engine · Intel
3.0 before 3.1.75; 4.0 before 4.0.25 · source: NVD
Affected product
CS
Converged Security Management Engine Firmware
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-0545
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-0545
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/pdf/ssa-631949.pdf
kc.mcafee.com
https://kc.mcafee.com/corporate/index?page=content&id=SB10321
security.netapp.com
https://security.netapp.com/advisory/ntap-20200611-0006/
support.lenovo.com
https://support.lenovo.com/de/en/product_security/len-30041
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html
More from Converged Security Management Engine Firmware
9.8
CVE-2019-0153
Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access
8.8
CVE-2019-0169
Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an unauthenticated user…
8.2
CVE-2018-3643
A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55,…
8.2
CVE-2018-3627
Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access
7.8
CVE-2022-29871
Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local…