Intel Converged Security Management Engine vulnerabilities

44 vulnerabilities

Known vulnerabilities in Intel Converged Security Management Engine, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.7CVE-2018-12196intel corporationintel(r) csme, server platform services, trusted execution engine and intel(r) active management technology+1
EPSS score
0.42%
Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow a privileged user to potentially execute arbitrary code via local access.6.7CVE-2018-12190intel corporationintel(r) csme, server platform services, trusted execution engine and intel(r) active management technology+2
EPSS score
0.38%
Insufficient input validation in Intel(r) CSME subsystem before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel(r) TXE before 3.1.60 or 4.0.10 may allow a privileged user to potentially enable an escalation of privilege via local access.4.6CVE-2018-12188intel corporationintel(r) csme, server platform services, trusted execution engine and intel(r) active management technology+2
EPSS score
0.34%
Insufficient input validation in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel TXE before version 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially modify data via physical access.7.6CVE-2018-12191intel corporationintel(r) csme, server platform services, trusted execution engine and intel(r) active management technology+3
EPSS score
0.48%
Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before versions 4.00.04.383 or SPS 4.01.02.174, or Intel(R) TXE before versions 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially execute arbitrary code via physical access.7.6CVE-2018-12208intel corporationintel(r) csme, server platform services, trusted execution engine and intel(r) active management technology+3
EPSS score
0.51%
Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel(R) TXE version before 3.1.60 or 4.0.10, or Intel(R) Server Platform Services before version 5.00.04.012 may allow an unauthenticated user to potentially execute arbitrary code via physical access.6.8CVE-2018-12185intel corporationintel(r) csme, server platform services, trusted execution engine and intel(r) active management technology+1
EPSS score
0.40%
Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow an unauthenticated user to potentially execute arbitrary code via physical access.7.2CVE-2018-12192intel corporationintel(r) csme, server platform services, trusted execution engine and intel(r) active management technology+2
EPSS score
0.47%
Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_04.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access.7.2CVE-2018-12199intel corporationintel(r) csme, server platform services, trusted execution engine and intel(r) active management technology+2
EPSS score
0.49%
Buffer overflow in an OS component in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel TXE version before 3.1.60 or 4.0.10 may allow a privileged user to potentially execute arbitrary code via physical access.4.4CVE-2018-12189intel corporationintel(r) csme, server platform services, trusted execution engine and intel(r) active management technology+2
EPSS score
0.29%
Unhandled exception in Content Protection subsystem in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel TXE before 3.1.60 or 4.0.10 may allow privileged user to potentially modify data via local access.7.2CVE-2018-12147intelconverged_security_management_engine_firmware+2
EPSS score
0.46%
Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access.7.2CVE-2018-3657intel corporationintel(r) active management technology+14
EPSS score
0.59%
Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may allow a privileged user to potentially execute arbitrary code with Intel AMT execution privilege via local access.6.8CVE-2018-3659intel corporationintel(r) platform trust technology (ptt)+2
EPSS score
0.43%
A vulnerability in Intel PTT module in Intel CSME firmware before version 12.0.5 and Intel TXE firmware before version 4.0 may allow an unauthenticated user to potentially disclose information via physical access.5.9CVE-2018-3616intel corporationintel(r) active management technology+14
EPSS score
2.39%
Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain the TLS session key via the network.8.2CVE-2018-3643intel corporationintel(r) converged security and management engine (csme) and intel(r) server platform services firmware+2
EPSS score
0.48%
A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55, 11.21.55, 12.0.6 or Intel(R) Server Platform Services firmware before version 4.x.04 may allow an attacker with administrative privileges to uncover certain platform secrets via local access or to potentially execute arbitrary code.5.3CVE-2018-3658intel corporationintel(r) active management technology+14
EPSS score
3.33%
Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with Intel AMT provisioned to potentially cause a partial denial of service via network access.7.3CVE-2018-3655intel corporationintel(r) csme before version 11.21.55, intel(r) server platform services before version 4.0 and intel(r) trusted execution engine firmware+3
EPSS score
0.46%
A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Execution Engine Firmware before version 3.1.55 may allow an unauthenticated user to potentially modify or disclose information via physical access.8.2CVE-2018-3627intel corporationintel converged security management engine (intel csme)+2
EPSS score
0.56%
Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access.6.7CVE-2020-0541intelconverged_security_management_engine_firmware
EPSS score
0.40%
Out-of-bounds write in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow a privileged user to potentially enable escalation of privilege via local access.7.8CVE-2020-0542intelconverged_security_management_engine_firmware
EPSS score
0.41%
Improper buffer restrictions in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an authenticated user to potentially enable escalation of privilege, information disclosure or denial of service via local access.7.5CVE-2020-0536intelconverged_security_management_engine_firmware+1
EPSS score
1.70%
Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and Intel(R) TXE versions before 3.1.75 and 4.0.25 may allow an unauthenticated user to potentially enable information disclosure via network access.