High severity · published Aug 11, 2023
CVE-2022-29871
Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Converged Security Management Engine Firmware · Intel
before 11.12.94; before 11.8.94; before 12.0.93; before 14.1.70; 14.5.0 before 14.5.50; before 15.0.45; +7 more · source: NVD
Affected product
CS
Converged Security Management Engine Firmware
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29871
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29871
Vendor Advisory
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00783.html
security.netapp.com
https://security.netapp.com/advisory/ntap-20230824-0002/
More from Converged Security Management Engine Firmware
9.8
CVE-2019-0153
Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access
8.8
CVE-2019-0169
Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an unauthenticated user…
8.2
CVE-2018-3643
A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55,…
8.2
CVE-2018-3627
Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access
7.8
CVE-2020-0542
Improper buffer restrictions in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an authenticated user to potentially enable escalation…