CVE-2018-12173 | ByteOS Network

Vulnerability Details :

CVE-2018-12173

Assigner-intel

Assigner Org ID-6dda929c-bb53-4a77-a76d-48e79601a1ce

Published At-10 Oct, 2018 | 18:00

Updated At-16 Sep, 2024 | 16:18

Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an unauthenticated attacker to potentially execute arbitrary code resulting in information disclosure, escalation of privilege and/or denial of service via local access.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:intel

Assigner Org ID:6dda929c-bb53-4a77-a76d-48e79601a1ce

Published At:10 Oct, 2018 | 18:00

Updated At:16 Sep, 2024 | 16:18

▼CVE Numbering Authority (CNA)

Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an unauthenticated attacker to potentially execute arbitrary code resulting in information disclosure, escalation of privilege and/or denial of service via local access.

Affected Products

Vendor

Intel Corporation

Product

Intel Server Boards Firmware

Versions

Affected

before 00.01.0014

Problem Types

Type	CWE ID	Description
text	N/A	Escalation of Privilege, Denial of Service, Information Disclosure

Type: text

CWE ID: N/A

Description: Escalation of Privilege, Denial of Service, Information Disclosure

References

Hyperlink	Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00179.html	x_refsource_CONFIRM
http://support.lenovo.com/us/en/solutions/LEN-24799	x_refsource_CONFIRM

Hyperlink: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00179.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://support.lenovo.com/us/en/solutions/LEN-24799

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00179.html	x_refsource_CONFIRM x_transferred
http://support.lenovo.com/us/en/solutions/LEN-24799	x_refsource_CONFIRM x_transferred

Hyperlink: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00179.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://support.lenovo.com/us/en/solutions/LEN-24799

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

Source:secure@intel.com

Published At:10 Oct, 2018 | 18:29

Updated At:03 Oct, 2019 | 00:03

Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an unauthenticated attacker to potentially execute arbitrary code resulting in information disclosure, escalation of privilege and/or denial of service via local access.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	7.6	HIGH	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary	2.0	7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.0

Base score: 7.6

Base severity: HIGH

Vector:

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.2

Base severity: HIGH

Vector:

AV:L/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

Intel Corporation

>>server_board_s2600bp_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_board_s2600bp_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_board_s2600bp>>-

cpe:2.3:h:intel:server_board_s2600bp:-:*:*:*:*:*:*:*

Intel Corporation

>>server_board_s2600wf_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_board_s2600wf_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_board_s2600wf>>-

cpe:2.3:h:intel:server_board_s2600wf:-:*:*:*:*:*:*:*

Intel Corporation

>>server_board_s2600st_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_board_s2600st_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_board_s2600st>>-

cpe:2.3:h:intel:server_board_s2600st:-:*:*:*:*:*:*:*

Intel Corporation

>>server_board_s2600bpr_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_board_s2600bpr_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_board_s2600bpr>>-

cpe:2.3:h:intel:server_board_s2600bpr:-:*:*:*:*:*:*:*

Intel Corporation

>>server_board_s2600wfr_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_board_s2600wfr_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_board_s2600wfr>>-

cpe:2.3:h:intel:server_board_s2600wfr:-:*:*:*:*:*:*:*

Intel Corporation

>>server_board_s2600str_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_board_s2600str_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_board_s2600str>>-

cpe:2.3:h:intel:server_board_s2600str:-:*:*:*:*:*:*:*

Intel Corporation

>>compute_module_hns2600bp_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:compute_module_hns2600bp_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>compute_module_hns2600bp>>-

cpe:2.3:h:intel:compute_module_hns2600bp:-:*:*:*:*:*:*:*

Intel Corporation

>>compute_module_hns2600bpr_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:compute_module_hns2600bpr_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>compute_module_hns2600bpr>>-

cpe:2.3:h:intel:compute_module_hns2600bpr:-:*:*:*:*:*:*:*

Intel Corporation

>>server_system_r2000wf_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_system_r2000wf_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_system_r2000wf>>-

cpe:2.3:h:intel:server_system_r2000wf:-:*:*:*:*:*:*:*

Intel Corporation

>>server_system_r1000wf_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_system_r1000wf_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_system_r1000wf>>-

cpe:2.3:h:intel:server_system_r1000wf:-:*:*:*:*:*:*:*

Intel Corporation

>>server_system_r1000wfr_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_system_r1000wfr_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_system_r1000wfr>>-

cpe:2.3:h:intel:server_system_r1000wfr:-:*:*:*:*:*:*:*

Intel Corporation

>>server_system_r2000wfr_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_system_r2000wfr_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_system_r2000wfr>>-

cpe:2.3:h:intel:server_system_r2000wfr:-:*:*:*:*:*:*:*

Intel Corporation

>>server_system_h2000g_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_system_h2000g_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_system_h2000g>>-

cpe:2.3:h:intel:server_system_h2000g:-:*:*:*:*:*:*:*

Intel Corporation

>>server_system_h2000gr_firmware>>Versions before 00.01.0014(exclusive)

cpe:2.3:o:intel:server_system_h2000gr_firmware:*:*:*:*:*:*:*:*

Intel Corporation

>>server_system_h2000gr>>-

cpe:2.3:h:intel:server_system_h2000gr:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-732	Primary	nvd@nist.gov

CWE ID: CWE-732

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://support.lenovo.com/us/en/solutions/LEN-24799	secure@intel.com	N/A
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00179.html	secure@intel.com	Vendor Advisory

Hyperlink: http://support.lenovo.com/us/en/solutions/LEN-24799

Source: secure@intel.com

Resource: N/A

Hyperlink: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00179.html

Source: secure@intel.com

Resource:

Vendor Advisory