CVE-2018-12173
Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an unauthenticated attacker to potentially execute arbitrary code resulting in information…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an unauthenticated attacker to potentially execute arbitrary code resulting in information disclosure, escalation of privilege and/or denial of service via local access.
- CVSS 3.0
- 7.6 HIGHCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.41% probability · 34th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-732
- Affected
- intel/server board s2600bp firmware · intel/server board s2600wf firmware · intel/server board s2600st firmware · intel/server board s2600bpr firmware · intel/server board s2600wfr firmware · intel/server board s2600str firmware · intel/compute module hns2600bp firmware · intel/compute module hns2600bpr firmware · intel/server system r2000wf firmware · intel/server system r1000wf firmware · intel/server system r1000wfr firmware · intel/server system r2000wfr firmware · intel/server system h2000g firmware · intel/server system h2000gr firmware
- Source
- secure@intel.com
References
- http://support.lenovo.com/us/en/solutions/LEN-24799
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00179.htmlVendor Advisory
- http://support.lenovo.com/us/en/solutions/LEN-24799
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00179.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.