Converged Security Management Engine Firmware vulnerabilities

Product

Converged Security Management Engine Firmware

by Intel · last CVE Aug 11, 2023

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities44 In the news0 Timeline

Severity mix

Critical 1High 15Medium 28Low 0

Severity

All severities44 Critical1 High15 Medium28 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Converged Security Management Engine Firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2019-0169	8.8	1%	Dec 18	Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an unauthenticated user… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45
CVE-2018-3643	8.2	0%	Sep 12	A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55,… Affected: before 12.0.6
CVE-2018-3627	8.2	1%	Jul 10	Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0
CVE-2022-29871	7.8	0%	Aug 11	Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local… Affected: before 11.12.94; before 11.8.94; before 12.0.93; before 14.1.70; 14.5.0 before 14.5.50; before 15.0.45; +7 more
CVE-2020-0542	7.8	0%	Jun 15	Improper buffer restrictions in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an authenticated user to potentially enable escalation… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77; 12.0 before 12.0.64; 13.0 before 13.0.32; 14.0 before 14.0.33; +1 more
CVE-2019-11147	7.8	0%	Dec 18	Insufficient access control in hardware abstraction driver for MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0, 14.0.10; TXEInfo… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45; 13.0 before 13.0.0; 14.0.0 before 14.0.10
CVE-2019-11104	7.8	0%	Dec 18	Insufficient input validation in MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-11103	7.8	0%	Dec 18	Insufficient input validation in firmware update software for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow an authenticated user to potentially enable… Affected: 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-0086	7.8	0%	May 17	Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65,… Affected: 11.0 before 11.8.65; 11.10 before 11.11.65; 11.20 before 11.22.65; 12.0 before 12.0.35
CVE-2018-12208	7.6	1%	Mar 14	Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel(R) TXE version before 3.1.60 or 4.0.10, or Intel(R) Server… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-12191	7.6	0%	Mar 14	Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before versions 4.00.04.383 or SPS… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2022-36392	7.5	1%	Aug 11	Improper input validation in some firmware for Intel(R) AMT and Intel(R) Standard Manageability before versions 11.8.94, 11.12.94, 11.22.94, 12.0.93, 14.1.70, 15.0.45, and 16.1.27… Affected: before 11.12.94; before 11.8.94; before 12.0.93; before 14.1.70; 14.5.0 before 14.5.50; before 15.0.45; +1 more
CVE-2020-0536	7.5	2%	Jun 15	Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and Intel(R) TXE versions before 3.1.75 and… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77; 12.0 before 12.0.64; 13.0 before 13.0.32; 14.0 before 14.0.33
CVE-2020-0534	7.5	2%	Jun 15	Improper input validation in the DAL subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an unauthenticated user to potentially enable… Affected: 12.0 before 12.0.64; 13.0 before 13.0.32; 14.0 before 14.0.33; 14.5.11
CVE-2018-3655	7.3	0%	Sep 12	A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Execution Engine Firmware before version… Affected: 11.0 through 11.8.50; 11.10 through 11.11.50; 11.20 through 11.21.51