Medium severity · published May 10, 2023
CVE-2022-37327
Improper input validation in BIOS firmware for Intel(R) NUC, Intel(R) NUC Performance Kit, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit,…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Improper input validation in BIOS firmware for Intel(R) NUC, Intel(R) NUC Performance Kit, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element, Intel(R) NUC Extreme, Intel(R) NUC 12 Extreme Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Enthusiast, Intel(R) NUC Essential, Intel(R) NUC Laptop Kit, Intel(R) NUC Extreme Compute Element, Intel(R) NUC Boards, Intel(R) NUC Pro Compute Element, Intel(R) NUC Rugged may allow a privileged user to enable information disclosure via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cm11ebc4w Firmware · Intel
before ebtgl357.0071 · source: NVD
CF
Cm11ebi38w Firmware · Intel
before ebtgl357.0071 · source: NVD
CF
Cm11ebi58w Firmware · Intel
before ebtgl357.0071 · source: NVD
CF
Cm11ebi716w Firmware · Intel
before ebtgl357.0071 · source: NVD
CF
Cm8ccb4r Firmware · Intel
before cbwhl357.0101 · source: NVD
CF
Cm8i3cb4n Firmware · Intel
before cbwhl357.0101 · source: NVD
CF
Cm8i5cb8n Firmware · Intel
before cbwhl357.0101 · source: NVD
CF
Cm8i7cb8n Firmware · Intel
before cbwhl357.0101 · source: NVD
CF
Cm8pcb4r Firmware · Intel
before cbwhl357.0101 · source: NVD
EF
Elm12hbc Firmware · Intel
before hbadl357.0052 · source: NVD
EF
Elm12hbi3 Firmware · Intel
before hbadl357.0052 · source: NVD
EF
Elm12hbi5 Firmware · Intel
before hbadl357.0052 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-37327
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-37327
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00777.html
More from Cm11ebc4w Firmware
7.8
CVE-2022-36339
Improper input validation in firmware for Intel(R) NUC 8 Compute Element, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element may allow a privileged user to enable…
4.4
CVE-2022-31477
Improper initialization for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access