Medium severity · published Feb 9, 2022
CVE-2021-33107
Insufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and Intel(R) MEBx before versions…
4.6
CVSS
0.3%
EPSS
No
On KEV
Description
Insufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and Intel(R) MEBx before versions 11.0.0.0012, 12.0.0.0011, 14.0.0.0004 and 15.0.0.0004 may allow an unauthenticated user to potentially enable information disclosure via physical access.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Active Management Technology Software Development Kit · Intel
before 16.0.3 · source: NVD
CI
Core I3 8100 Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3 8100f Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3 8100t Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3 8300 Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3 8300t Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3 8350k Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3 9100 Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3 9100f Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3 9100t Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3 9300 Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3 9300t Firmware · Intel
All versions, or not specified · source: NVD
Affected product
AM
Active Management Technology Software Development Kit
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33107
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33107
Patch
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00575.html
Patch
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00601.html
More from Active Management Technology Software Development Kit
8.8
CVE-2022-26341
Insufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1, Intel(R) EMA before version 1.7.1 and Intel(R) MC before version 2.3.2 may allow an…
7.8
CVE-2020-12354
Incorrect default permissions in Windows(R) installer in Intel(R) AMT SDK versions before 14.0.0.1 may allow an authenticated user to potentially enable escalation of privilege…