Medium severity · published Nov 12, 2020
CVE-2020-12309
Insufficiently protected credentialsin subsystem in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable…
4.6
CVSS
0.3%
EPSS
No
On KEV
Description
Insufficiently protected credentialsin subsystem in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via physical access.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Optane Ssd 900p Firmware · Intel
before e2010480 · source: NVD
OS
Optane Ssd 905p Firmware · Intel
before e2010480 · source: NVD
S6
Ssd 660p Firmware · Intel
before 004c · source: NVD
S7
Ssd 760p Firmware · Intel
before 005c · source: NVD
SD
Ssd DC P4101 Firmware · Intel
before 008d · source: NVD
SD
Ssd DC P4510 Firmware · Intel
before vdv10170 · source: NVD
SD
Ssd DC P4610 Firmware · Intel
before vdv10170 · source: NVD
SD
Ssd DC P4800x Firmware · Intel
before e2010485 · source: NVD
SD
Ssd DC P4801x Firmware · Intel
before e2010485 · source: NVD
SE
Ssd E 5100s Firmware · Intel
before lhf004e; before lhf0ae3 · source: NVD
SE
Ssd E 6100p Firmware · Intel
before 005e · source: NVD
SP
Ssd Pro 5400s Firmware · Intel
before lbf017p; before lsf043p · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-12309
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-12309
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00362
More from Optane Ssd 900p Firmware
7.8
CVE-2023-27519
Improper input validation in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable escalation of privilege via local access
6.8
CVE-2021-33080
Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC Products…
6.8
CVE-2021-33077
Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow an unauthenticated user to potentially…
6.2
CVE-2020-0584
Buffer overflow in firmware for Intel(R) SSD DC P4800X and P4801X Series, Intel(R) Optane(TM) SSD 900P and 905P Series may allow an unauthenticated user to potentially enable a…
5.5
CVE-2023-27306
Improper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow an authenticated user to potentially enable denial of service via local access