CVE-2020-8745: intel converged_security_and_manageability_engine
Vulnerability summary
CVE-2020-8745 is a medium (CVSS 6.8) vulnerability in intel converged_security_and_manageability_engine. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.8% of scored vulnerabilities.
Timeline
- 12-11-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
0.00 pp
From 0.38% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Siemens20 products
- simatic_drive_controller_firmware< 05.00.01.00
- simatic_et200sp_1515sp_pc2_firmware< 0209.0105
- simatic_field_pg_m5_firmware< 22.01.08
- simatic_field_pg_m6_firmwarena
- simatic_ipc127e_firmware< 27.01.05
Intel2 products
- converged_security_and_manageability_engine< 11.8.80 | ≥ 11.12.0, < 11.12.80 | ≥ 11.22.0, < 11.22.80 | ≥ 12.0, < 12.0.70 | ≥ 14.0, < 14.0.45 | ≥ 14.5.0, < 14.5.25
- trusted_execution_technology< 3.1.80 | ≥ 4.0, < 4.0.30
2 vendors · 22 products
References
4 links- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391X Refsource MISCVendor Advisory