Active Management Technology Firmware vulnerabilities

Product

Active Management Technology Firmware

by Intel · last CVE Nov 11, 2022

On CISA KEVExploited in the wild

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities54 In the news0 Timeline

Severity mix

Critical 10High 21Medium 23Low 0

Severity

All severities54 Critical10 High21 Medium23 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add Active Management Technology Firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2022-28697	6.8	0%	Aug 18	Improper access control in firmware for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable escalation of privilege via… Affected: All versions, or not specified
CVE-2019-11086	6.8	0%	Dec 18	Insufficient input validation in subsystem for Intel(R) AMT before version 12.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via physical… Affected: 12.0 before 12.0.45
CVE-2019-0092	6.8	0%	May 17	Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially… Affected: 11.8.0 before 11.8.65; 11.11.0 before 11.11.65; 11.22.0 before 11.22.65; 12.0 before 12.0.35
CVE-2021-33159	6.7	0%	Nov 11	Improper authentication in subsystem for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow a privileged user to potentially… Affected: before 11.8.93; 11.12.0 before 11.12.93; 11.22.0 before 11.22.93; 12.0 before 12.0.92; 14.1 before 14.1.67; 15.0 before 15.0.42; +1 more
CVE-2020-8757	6.7	0%	Nov 12	Out-of-bounds read in subsystem for Intel(R) AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow a privileged user to potentially enable escalation of… Affected: before 11.8.80; 11.12.0 before 11.12.80; 11.22.0 before 11.22.80; 12.0 before 12.0.70; 14.0 before 14.0.45
CVE-2018-3657	6.7	1%	Sep 12	Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may allow a privileged user to potentially execute arbitrary code with Intel AMT… Affected: before 12.0.5
CVE-2018-3632	6.7	0%	Jul 10	Memory corruption in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 6.x / 7.x / 8.x / 9.x / 10.x / 11.0 / 11.5 / 11.6 / 11.7 / 11.10… Affected: 6.0 through 11.20; 6.0 through 11.20; 6.0 through 11.20; 6.0 through 11.20; 6.0 through 11.20; 6.0 through 11.20; +3 more
CVE-2021-33068	6.5	1%	Feb 9	Null pointer dereference in subsystem for Intel(R) AMT before versions 15.0.35 may allow an authenticated user to potentially enable denial of service via network access Affected: before 15.0.35
CVE-2020-8746	6.5	1%	Nov 12	Integer overflow in subsystem for Intel(R) AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow an unauthenticated user to potentially enable denial of… Affected: before 11.8.80; 11.12.0 before 11.12.80; 11.22.0 before 11.22.80; 12.0 before 12.0.70; 14.0 before 14.0.45
CVE-2020-0531	6.5	1%	Jun 15	Improper input validation in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an authenticated user to potentially enable information disclosure via… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77; 12.0 before 12.0.64
CVE-2018-3629	6.5	1%	Jul 10	Buffer overflow in event handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5.x, 6.x, 7.x, 8.x, 9.x, 10.x, and 11.x… Affected: 3.0 through 11.22.70; 3.0 through 11.22.70; 3.0 through 11.22.70; 3.0 through 11.22.70; 3.0 through 11.22.70; 3.0 through 11.22.70; +3 more
CVE-2017-5697	6.5	1%	Jun 14	Insufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions before 9.1.40.1000, 9.5.60.1952, 10.0.50.1004, 11.0.0.1205, and 11.6.25.1129… Affected: 9.1 before 9.1.40.1000; 9.5 before 9.5.60.1952; 10.0 before 10.0.50.1004; 11.0 before 11.0.0.1205; 11.6 before 11.6.25.1129
CVE-2018-3616	5.9	2%	Sep 12	Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain… Affected: before 12.0.5
CVE-2022-30944	5.5	0%	Aug 18	Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclosure via local access Affected: All versions, or not specified
CVE-2020-8674	5.3	2%	Jun 15	Out-of-bounds read in DHCPv6 subsystem in Intel(R) AMT and Intel(R)ISM versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64 and 14.0.33 may allow an unauthenticated user to… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77; 12.0 before 12.0.64; 14.0 before 14.0.33
CVE-2020-0535	5.3	2%	Jun 15	Improper input validation in Intel(R) AMT versions before 11.8.76, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentially enable information disclosure… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77; 12.0 before 12.0.64
CVE-2018-3658	5.3	3%	Sep 12	Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with Intel AMT provisioned to potentially cause a partial denial… Affected: before 12.0.5
CVE-2020-0537	4.9	2%	Jun 15	Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow a privileged user to potentially enable denial of service… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77; 12.0 before 12.0.64
CVE-2019-0097	4.9	1%	May 17	Insufficient input validation vulnerability in subsystem for Intel(R) AMT before version 12.0.35 may allow a privileged user to potentially enable denial of service via network… Affected: 12.0.20 before 12.0.35
CVE-2019-11100	4.6	0%	Dec 18	Insufficient input validation in the subsystem for Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45
CVE-2020-12356	4.4	0%	Nov 12	Out-of-bounds read in subsystem in Intel(R) AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow a privileged user to potentially enable information… Affected: before 11.8.80; 11.12.0 before 11.12.80; 11.22.0 before 11.22.80; 12.0 before 12.0.70; 14.0 before 14.0.45
CVE-2017-5698	4.4	0%	Sep 5	Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology firmware versions 11.0.25.3001 and 11.0.26.3000 anti-rollback will not… Affected: 11.0.25.3001; 11.0.26.3000
CVE-2019-0094	4.3	0%	May 17	Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially… Affected: 11.8.0 before 11.8.65; 11.11.0 before 11.11.65; 11.22.0 before 11.22.65; 12.0 before 12.0.35