CVE-2017-5689: Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability

Vulnerability summary

CVE-2017-5689 is a high (CVSS 10.0) Improper Privilege Management vulnerability in Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability. It is known to be exploited: CISA lists it, first on 28-01-2022. EPSS estimates a 92.19% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 02-05-2017
   PublishedVulnerability first disclosed.
2. 28-01-2022
   Added to CISA KEVIntel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability
3. 28-07-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.