Converged Security Management Engine Firmware vulnerabilities

Product

Converged Security Management Engine Firmware

by Intel · last CVE Aug 11, 2023

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities44 In the news0 Timeline

Severity mix

Critical 1High 15Medium 28Low 0

Severity

All severities44 Critical1 High15 Medium28 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Converged Security Management Engine Firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2019-0153	9.8	2%	May 17	Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access Affected: before 12.0.35
CVE-2019-0169	8.8	1%	Dec 18	Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an unauthenticated user… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45
CVE-2018-3643	8.2	0%	Sep 12	A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55,… Affected: before 12.0.6
CVE-2018-3627	8.2	1%	Jul 10	Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0
CVE-2022-29871	7.8	0%	Aug 11	Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local… Affected: before 11.12.94; before 11.8.94; before 12.0.93; before 14.1.70; 14.5.0 before 14.5.50; before 15.0.45; +7 more
CVE-2020-0542	7.8	0%	Jun 15	Improper buffer restrictions in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an authenticated user to potentially enable escalation… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77; 12.0 before 12.0.64; 13.0 before 13.0.32; 14.0 before 14.0.33; +1 more
CVE-2019-11147	7.8	0%	Dec 18	Insufficient access control in hardware abstraction driver for MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0, 14.0.10; TXEInfo… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45; 13.0 before 13.0.0; 14.0.0 before 14.0.10
CVE-2019-11104	7.8	0%	Dec 18	Insufficient input validation in MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-11103	7.8	0%	Dec 18	Insufficient input validation in firmware update software for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow an authenticated user to potentially enable… Affected: 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-0086	7.8	0%	May 17	Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65,… Affected: 11.0 before 11.8.65; 11.10 before 11.11.65; 11.20 before 11.22.65; 12.0 before 12.0.35
CVE-2018-12208	7.6	1%	Mar 14	Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel(R) TXE version before 3.1.60 or 4.0.10, or Intel(R) Server… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-12191	7.6	0%	Mar 14	Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before versions 4.00.04.383 or SPS… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2022-36392	7.5	1%	Aug 11	Improper input validation in some firmware for Intel(R) AMT and Intel(R) Standard Manageability before versions 11.8.94, 11.12.94, 11.22.94, 12.0.93, 14.1.70, 15.0.45, and 16.1.27… Affected: before 11.12.94; before 11.8.94; before 12.0.93; before 14.1.70; 14.5.0 before 14.5.50; before 15.0.45; +1 more
CVE-2020-0536	7.5	2%	Jun 15	Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and Intel(R) TXE versions before 3.1.75 and… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77; 12.0 before 12.0.64; 13.0 before 13.0.32; 14.0 before 14.0.33
CVE-2020-0534	7.5	2%	Jun 15	Improper input validation in the DAL subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an unauthenticated user to potentially enable… Affected: 12.0 before 12.0.64; 13.0 before 13.0.32; 14.0 before 14.0.33; 14.5.11
CVE-2018-3655	7.3	0%	Sep 12	A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Execution Engine Firmware before version… Affected: 11.0 through 11.8.50; 11.10 through 11.11.50; 11.20 through 11.21.51
CVE-2019-0098	6.8	0%	May 17	Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticated user to potentially enable… Affected: 11.0 before 11.8.65; 11.10 before 11.11.65; 11.20 before 11.22.65; 12.0 before 12.0.35
CVE-2018-12185	6.8	0%	Mar 14	Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow an unauthenticated user to potentially execute… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-12192	6.8	0%	Mar 14	Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_04.00.04.393.0 may… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-3659	6.8	0%	Sep 12	A vulnerability in Intel PTT module in Intel CSME firmware before version 12.0.5 and Intel TXE firmware before version 4.0 may allow an unauthenticated user to potentially… Affected: before 12.0.5
CVE-2020-0541	6.7	0%	Jun 15	Out-of-bounds write in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow a privileged user to potentially enable escalation of privilege… Affected: 12.0 before 12.0.64; 13.0 before 13.0.32; 14.0 before 14.0.33; 14.5.11
CVE-2020-0533	6.7	0%	Jun 15	Reversible one-way hash in Intel(R) CSME versions before 11.8.76, 11.12.77 and 11.22.77 may allow a privileged user to potentially enable escalation of privilege, denial of… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77
CVE-2019-14598	6.7	0%	Feb 13	Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a… Affected: 12.0 before 12.0.48; 12.0 before 12.0.56; 13.0 before 13.0.20; 14.0 before 14.0.10
CVE-2019-11110	6.7	0%	Dec 18	Authentication bypass in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-11108	6.7	0%	Dec 18	Insufficient input validation in subsystem for Intel(R) CSME before versions 12.0.45 and 13.0.10 may allow a privileged user to potentially enable escalation of privilege via… Affected: 12.0 before 12.0.45; 13.0 before 13.0.10
CVE-2019-11106	6.7	0%	Dec 18	Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow… Affected: 11.0 before 11.8.70; 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-11105	6.7	0%	Dec 18	Logic issue in subsystem for Intel(R) CSME before versions 12.0.45, 13.0.10 and 14.0.10 may allow a privileged user to potentially enable escalation of privilege and information… Affected: 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-11087	6.7	0%	Dec 18	Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2018-12147	6.7	0%	Jun 13	Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine… Affected: 11.0 through 11.8.50; 11.10 through 11.11.50; 11.20 through 11.21.51
CVE-2019-0170	6.7	0%	May 17	Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to potentially enable escalation of privilege via local access Affected: before 12.0.35
CVE-2018-12196	6.7	0%	Mar 14	Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow a privileged user to potentially execute arbitrary… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-12190	6.7	0%	Mar 14	Insufficient input validation in Intel(r) CSME subsystem before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel(r) TXE before 3.1.60 or 4.0.10 may allow a privileged user… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-3657	6.7	1%	Sep 12	Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may allow a privileged user to potentially execute arbitrary code with Intel AMT… Affected: 11.0.0 before 12.0.5
CVE-2018-12199	6.2	0%	Mar 14	Buffer overflow in an OS component in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel TXE version before 3.1.60 or 4.0.10 may allow a privileged user… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-3616	5.9	2%	Sep 12	Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain… Affected: 11.0.0 before 12.0.5
CVE-2020-0539	5.5	0%	Jun 15	Path traversal in subsystem for Intel(R) DAL software for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33 and Intel(R) TXE versions before… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77; 12.0 before 12.0.64; 13.0 before 13.0.32; 14.0 before 14.0.33
CVE-2018-3658	5.3	3%	Sep 12	Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with Intel AMT provisioned to potentially cause a partial denial… Affected: 11.0.0 before 12.0.5
CVE-2018-12188	4.6	0%	Mar 14	Insufficient input validation in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel TXE before version 3.1.60 or 4.0.10 may allow an unauthenticated user… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2022-38102	4.4	0%	Aug 11	Improper Input validation in firmware for some Intel(R) Converged Security and Management Engine before versions 15.0.45, and 16.1.27 may allow a privileged user to potentially… Affected: before 16.1.27; before 15.0.45
CVE-2020-0545	4.4	0%	Jun 15	Integer overflow in subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77 and Intel(R) TXE versions before 3.1.75, 4.0.25 and Intel(R) Server Platform Services… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77
CVE-2019-11101	4.4	0%	Dec 18	Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-0168	4.4	0%	Dec 18	Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45 and 13.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a… Affected: 11.0 before 11.8.70; 12.0 before 12.0.45; 13.0 before 13.0.10
CVE-2019-0165	4.4	0%	Dec 18	Insufficient Input validation in the subsystem for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow a privileged user to potentially enable denial of service… Affected: 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2018-12189	4.4	0%	Mar 14	Unhandled exception in Content Protection subsystem in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel TXE before 3.1.60 or 4.0.10 may allow privileged… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20