Medium severity · published Aug 13, 2020
CVE-2020-8742
Improper input validation in the firmware for Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access
6.7
CVSS
0.3%
EPSS
No
On KEV
Description
Improper input validation in the firmware for Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cd1c32gk Firmware · Intel
before gkaplcpx.86a · source: NVD
CF
Cd1c64gk Firmware · Intel
before gkaplcpx.86a · source: NVD
CF
Cd1p64gk Firmware · Intel
before gkaplcpx.86a · source: NVD
DF
De3815tybe Firmware · Intel
before tybyt20h.86a; before tybyt10h.86a · source: NVD
DF
De3815tykhe Firmware · Intel
before tybyt20h.86a; before tybyt10h.86a · source: NVD
NF
Nuc5cpyh Firmware · Intel
before pybswcel.86a · source: NVD
NF
Nuc5pgyh Firmware · Intel
before pybswcel.86a · source: NVD
NF
Nuc6cayh Firmware · Intel
before ayaplcel.86a · source: NVD
NF
Nuc6cays Firmware · Intel
before ayaplcel.86a · source: NVD
NF
Nuc6i7kyk Firmware · Intel
before kyskli70.86a · source: NVD
NF
Nuc7cjyh Firmware · Intel
before jyglkcpx.86a · source: NVD
NF
Nuc7cjysal Firmware · Intel
before jyglkcpx.86a · source: NVD