Medium severity · published Nov 12, 2020
CVE-2020-8705
Insecure default initialization of resource in Intel(R) Boot Guard in Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25,…
6.8
CVSS
0.5%
EPSS
No
On KEV
Description
Insecure default initialization of resource in Intel(R) Boot Guard in Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE versions before 3.1.80 and 4.0.30, Intel(R) SPS versions before E5_04.01.04.400, E3_04.01.04.200, SoC-X_04.00.04.200 and SoC-A_04.00.04.300 may allow an unauthenticated user to potentially enable escalation of privileges via physical access.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Converged Security And Manageability Engine · Intel
before 11.8.80; 11.12.0 before 11.12.80; 11.22.0 before 11.22.80; 12.0 before 12.0.70; 13.0 before 13.0.40; 13.30.0 before 13.30.10; +1 more · source: NVD
SP
Server Platform Services · Intel
sps_e3_04.01.04.200; sps_e5_04.01.04.400; sps_soc-a_04.00.04.300; sps_soc-x_04.00.04.200 · source: NVD
TE
Trusted Execution Technology · Intel
3.1.80; 4.0.30 · source: NVD
Affected product
CS
Converged Security And Manageability Engine
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8705
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8705
Third Party Advisory
https://security.netapp.com/advisory/ntap-20201113-0002/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20201113-0004/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20201113-0005/
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391
More from Converged Security And Manageability Engine
7.8
CVE-2020-12303
Use after free in DAL subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE 3.1.80, 4.0.30 may…
7.8
CVE-2020-12297
Improper access control in Installer for Intel(R) CSME Driver for Windows versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel TXE…
6.8
CVE-2020-24516
Modification of assumed-immutable data in subsystem in Intel(R) CSME versions before 13.0.47, 13.30.17, 14.1.53, 14.5.32, 15.0.22 may allow an unauthenticated user to potentially…
6.8
CVE-2020-8745
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE…
6.7
CVE-2020-8703
Improper buffer restrictions in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and 15.0.22 may allow a…