CVE-2022-34147: intel cm8ccb4r_firmware Improper Input Validation

Vulnerability summary

CVE-2022-34147 is a high (CVSS 7.8) Improper Input Validation vulnerability in intel cm8ccb4r_firmware. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.4% of scored vulnerabilities.

Timeline

1. 10-05-2023
   PublishedVulnerability first disclosed.
2. 27-01-2025
   Last modifiedVulnerability information updated.

Description

Improper input validation in BIOS firmware for some Intel(R) NUC 9 Extreme Laptop Kits, Intel(R) NUC Performance Kits, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, and Intel(R) NUC Compute Element may allow a privileged user to potentially enable escalation of privilege via local access.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.