Converged Security Management Engine Firmware vulnerabilities

Product

Converged Security Management Engine Firmware

by Intel · last CVE Aug 11, 2023

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities44 In the news0 Timeline

Severity mix

Critical 1High 15Medium 28Low 0

Severity

All severities44 Critical1 High15 Medium28 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Converged Security Management Engine Firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2019-0098	6.8	0%	May 17	Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticated user to potentially enable… Affected: 11.0 before 11.8.65; 11.10 before 11.11.65; 11.20 before 11.22.65; 12.0 before 12.0.35
CVE-2018-12185	6.8	0%	Mar 14	Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow an unauthenticated user to potentially execute… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-12192	6.8	0%	Mar 14	Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_04.00.04.393.0 may… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-3659	6.8	0%	Sep 12	A vulnerability in Intel PTT module in Intel CSME firmware before version 12.0.5 and Intel TXE firmware before version 4.0 may allow an unauthenticated user to potentially… Affected: before 12.0.5
CVE-2020-0541	6.7	0%	Jun 15	Out-of-bounds write in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow a privileged user to potentially enable escalation of privilege… Affected: 12.0 before 12.0.64; 13.0 before 13.0.32; 14.0 before 14.0.33; 14.5.11
CVE-2020-0533	6.7	0%	Jun 15	Reversible one-way hash in Intel(R) CSME versions before 11.8.76, 11.12.77 and 11.22.77 may allow a privileged user to potentially enable escalation of privilege, denial of… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77
CVE-2019-14598	6.7	0%	Feb 13	Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a… Affected: 12.0 before 12.0.48; 12.0 before 12.0.56; 13.0 before 13.0.20; 14.0 before 14.0.10
CVE-2019-11110	6.7	0%	Dec 18	Authentication bypass in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-11108	6.7	0%	Dec 18	Insufficient input validation in subsystem for Intel(R) CSME before versions 12.0.45 and 13.0.10 may allow a privileged user to potentially enable escalation of privilege via… Affected: 12.0 before 12.0.45; 13.0 before 13.0.10
CVE-2019-11106	6.7	0%	Dec 18	Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow… Affected: 11.0 before 11.8.70; 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-11105	6.7	0%	Dec 18	Logic issue in subsystem for Intel(R) CSME before versions 12.0.45, 13.0.10 and 14.0.10 may allow a privileged user to potentially enable escalation of privilege and information… Affected: 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-11087	6.7	0%	Dec 18	Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2018-12147	6.7	0%	Jun 13	Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine… Affected: 11.0 through 11.8.50; 11.10 through 11.11.50; 11.20 through 11.21.51
CVE-2019-0170	6.7	0%	May 17	Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to potentially enable escalation of privilege via local access Affected: before 12.0.35
CVE-2018-12196	6.7	0%	Mar 14	Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow a privileged user to potentially execute arbitrary… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-12190	6.7	0%	Mar 14	Insufficient input validation in Intel(r) CSME subsystem before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel(r) TXE before 3.1.60 or 4.0.10 may allow a privileged user… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-3657	6.7	1%	Sep 12	Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may allow a privileged user to potentially execute arbitrary code with Intel AMT… Affected: 11.0.0 before 12.0.5
CVE-2018-12199	6.2	0%	Mar 14	Buffer overflow in an OS component in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel TXE version before 3.1.60 or 4.0.10 may allow a privileged user… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2018-3616	5.9	2%	Sep 12	Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain… Affected: 11.0.0 before 12.0.5
CVE-2020-0539	5.5	0%	Jun 15	Path traversal in subsystem for Intel(R) DAL software for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33 and Intel(R) TXE versions before… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77; 12.0 before 12.0.64; 13.0 before 13.0.32; 14.0 before 14.0.33
CVE-2018-3658	5.3	3%	Sep 12	Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with Intel AMT provisioned to potentially cause a partial denial… Affected: 11.0.0 before 12.0.5
CVE-2018-12188	4.6	0%	Mar 14	Insufficient input validation in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel TXE before version 3.1.60 or 4.0.10 may allow an unauthenticated user… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20
CVE-2022-38102	4.4	0%	Aug 11	Improper Input validation in firmware for some Intel(R) Converged Security and Management Engine before versions 15.0.45, and 16.1.27 may allow a privileged user to potentially… Affected: before 16.1.27; before 15.0.45
CVE-2020-0545	4.4	0%	Jun 15	Integer overflow in subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77 and Intel(R) TXE versions before 3.1.75, 4.0.25 and Intel(R) Server Platform Services… Affected: 11.0 before 11.8.77; 11.10 before 11.12.77; 11.20 before 11.22.77
CVE-2019-11101	4.4	0%	Dec 18	Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and… Affected: 11.0 before 11.8.70; 11.10 before 11.11.70; 11.20 before 11.22.70; 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2019-0168	4.4	0%	Dec 18	Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45 and 13.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a… Affected: 11.0 before 11.8.70; 12.0 before 12.0.45; 13.0 before 13.0.10
CVE-2019-0165	4.4	0%	Dec 18	Insufficient Input validation in the subsystem for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow a privileged user to potentially enable denial of service… Affected: 12.0 before 12.0.45; 13.0 before 13.0.10; 14.0.0 before 14.0.10
CVE-2018-12189	4.4	0%	Mar 14	Unhandled exception in Content Protection subsystem in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel TXE before 3.1.60 or 4.0.10 may allow privileged… Affected: 11.0 before 11.8.60; 11.10 before 11.11.60; 11.20 before 11.22.60; 12.0.0 before 12.0.20