High severity · published Aug 13, 2020
CVE-2020-8708
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation…
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Compute Module Hns2600bp Firmware · Intel
before 1.59 · source: NVD
CM
Compute Module Hns2600kp Firmware · Intel
before 1.59 · source: NVD
CM
Compute Module Hns2600tp Firmware · Intel
before 1.59 · source: NVD
CM
Compute Module S2600tp Firmware · Intel
before 1.59 · source: NVD
SB
Server Board S1200sp Firmware · Intel
before 1.59 · source: NVD
SB
Server Board S2600bp Firmware · Intel
before 1.59 · source: NVD
SB
Server Board S2600cw · Intel
before 1.59 · source: NVD
SB
Server Board S2600kp Firmware · Intel
before 1.59 · source: NVD
SB
Server Board S2600st Firmware · Intel
before 1.59 · source: NVD
SB
Server Board S2600wf Firmware · Intel
before 1.59 · source: NVD
SB
Server Board S2600wt Firmware · Intel
before 1.59 · source: NVD
SS
Server System Lr1304sp Firmware · Intel
before 1.59 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8708
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8708
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200814-0002/
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00384.html
More from Compute Module Hns2600bp Firmware
8.8
CVE-2020-8732
Heap-based buffer overflow in the firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially…
8.8
CVE-2020-8731
Incorrect execution-assigned permissions in the file system for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user…
8.8
CVE-2020-8730
Heap-based overflow for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of…
8.8
CVE-2020-8718
Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable…
8.8
CVE-2020-8713
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation…