Medium severity · published Sep 20, 2022
CVE-2021-33076
Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S6
Ssd 600p Firmware · Intel
before 122c · source: NVD
S6
Ssd 660p Firmware · Intel
before 005c · source: NVD
S6
Ssd 665p Firmware · Intel
before 002c · source: NVD
S6
Ssd 670p Firmware · Intel
before 003c · source: NVD
S7
Ssd 700p Firmware · Intel
before 005c · source: NVD
S7
Ssd 760p Firmware · Intel
before 006c · source: NVD
SD
Ssd D3-s4510 M.2 Firmware · Intel
before xc311132 · source: NVD
SD
Ssd D3-s4610 M.2 Firmware · Intel
before xc311132 · source: NVD
SD
Ssd D5-p4326 Firmware · Intel
before 8dv1md58 · source: NVD
SD
Ssd D5-p5316 Firmware · Intel
before acv10200 · source: NVD
SD
Ssd D7 P5510 Firmware · Intel
before jcv10200 · source: NVD
SD
Ssd D7 P5600 Firmware · Intel
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33076
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33076
Mitigation
https://www.solidigm.com/content/dam/newco-aem-site/master/site/support/Solidigm%20SA-000563%20rev1.1.pdf
More from Ssd 600p Firmware
4.4
CVE-2021-33081
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access
4.4
CVE-2021-33079
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access