CVE-2018-3643: intel corporation intel(r) converged security and management engine (csme) and intel(r) server platform services firmware
Vulnerability summary
CVE-2018-3643 is a high (CVSS 8.2) vulnerability in intel corporation intel(r) converged security and management engine (csme) and intel(r) server platform services firmware. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities.
Timeline
- 12-09-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55, 11.21.55, 12.0.6 or Intel(R) Server Platform Services firmware before version 4.x.04 may allow an attacker with administrative privileges to uncover certain platform secrets via local access or to potentially execute arbitrary code.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
+0.02 pp
From 0.46% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Intel2 products
Intel corporation1 product
- intel(r) converged security and management engine (csme) and intel(r) server platform services firmwareCSME versions before 12.0.6 or Server Platform Services firmware before version 4.x.04.
2 vendors · 3 products
References
3 links- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00131.htmlX Refsource CONFIRMVendor Advisory
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03873en_usX Refsource CONFIRMPatchThird Party Advisory