ByteOS Network

Vulnerability Details :

CVE-2023-26592

Assigner-intel

Assigner Org ID-6dda929c-bb53-4a77-a76d-48e79601a1ce

Published At-14 Feb, 2024 | 13:37

Updated At-08 Aug, 2024 | 13:39

Deserialization of untrusted data in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable a denial of service via local access.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:intel

Assigner Org ID:6dda929c-bb53-4a77-a76d-48e79601a1ce

Published At:14 Feb, 2024 | 13:37

Updated At:08 Aug, 2024 | 13:39

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

Intel(R) Thunderbolt(TM) DCH drivers for Windows

Default Status

unaffected

Versions

Affected

before version 88

Problem Types

Type	CWE ID	Description
N/A	N/A	denial of service
CWE	CWE-502	Deserialization of untrusted data

Type: N/A

CWE ID: N/A

Description: denial of service

Type: CWE

CWE ID: CWE-502

Description: Deserialization of untrusted data

Metrics

Version	Base score	Base severity	Vector
3.1	3.8	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Version: 3.1

Base score: 3.8

Base severity: LOW

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

References

Hyperlink	Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html	N/A

Hyperlink: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html	x_transferred

Hyperlink: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@intel.com

Published At:14 Feb, 2024 | 14:15

Updated At:10 Oct, 2024 | 21:26

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	3.8	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Secondary	3.1	3.8	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Type: Primary

Version: 3.1

Base score: 3.8

Base severity: LOW

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Type: Secondary

Version: 3.1

Base score: 3.8

Base severity: LOW

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

CPE Matches

Intel Corporation

>>thunderbolt_dch_driver>>Versions before 88(exclusive)

cpe:2.3:a:intel:thunderbolt_dch_driver:*:*:*:*:*:windows:*:*

Weaknesses

CWE ID	Type	Source
CWE-502	Primary	nvd@nist.gov
CWE-502	Secondary	secure@intel.com

CWE ID: CWE-502

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-502

Type: Secondary

Source: secure@intel.com

References

Hyperlink	Source	Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html	secure@intel.com	Vendor Advisory

Hyperlink: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html

Source: secure@intel.com

Resource:

Vendor Advisory

Similar CVEs

1Records found

CVE-2021-44228

Matching Score-6

Assigner-Apache Software Foundation

View Details

Matching Score-6

Assigner-Apache Software Foundation

CVSS Score-10||CRITICAL

EPSS-94.36% / 99.96%

7 Day CHG~0.00%

Published-10 Dec, 2021 | 00:00

Updated-08 Aug, 2025 | 18:52

Known KEV||Action Due Date - 2021-12-24||For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Vendor-percussion snowsoftware Apple Inc.The Apache Software Foundation Fedora Project Cisco Systems, Inc.Siemens AG Intel Corporation NetApp, Inc.Bentley Systems, Incorporated SonicWall Inc.Debian GNU/Linux

Product-common_services_platform_collector solidfire_enterprise_sds oncommand_insight datacenter_manager active_iq_unified_manager operation_scheduler connected_analytics_for_network_deployment industrial_edge_management_hub snapcenter integrated_management_controller_supervisor firepower_1150 iot_operations_dashboard wan_automation_engine firepower_2140 system_studio virtualized_voice_browser firepower_2110 dna_center solid_edge_cam_pro 6bk1602-0aa42-0tp0 energyip comos secure_device_onboard firepower_4120 sppa-t3000_ses3000_firmware siveillance_viewpoint firepower_1120 genomics_kernel_library contact_center_domain_manager crosswork_data_gateway xpedition_package_integrator network_dashboard_fabric_controller 6bk1602-0aa22-0tp0_firmware cloud_secure_agent nexus_insights 6bk1602-0aa22-0tp0 firepower_1010 6bk1602-0aa32-0tp0 email_security unified_contact_center_management_portal opcenter_intelligence xcode dna_spaces_connector finesse solidfire_\&_hci_storage_node packaged_contact_center_enterprise unified_sip_proxy cloudcenter_suite ucs_director energy_engage fxos customer_experience_cloud_agent paging_server logo\!_soft_comfort firepower_2130 siveillance_control_pro spectrum_power_7 cloud_manager network_insights_for_data_center synchro_4d 6bk1602-0aa52-0tp0 solid_edge_harness_design fog_director network_assurance_engine firepower_4115 nexus_dashboard smart_phy business_process_automation 6bk1602-0aa42-0tp0_firmware broadworks firepower_4140 emergency_responder ucs_central computer_vision_annotation_tool video_surveillance_manager connected_mobile_experiences synchro head-end_system_universal_device_integration_system sentron_powermanager fedora cloudcenter_cost_optimizer 6bk1602-0aa12-0tp0_firmware spectrum_power_4 cloudcenter vm_access_proxy cloudcenter_suite_admin oneapi_sample_browser 6bk1602-0aa52-0tp0_firmware firepower_4150 virtual_topology_system firepower_9300 prime_service_catalog brocade_san_navigator enterprise_chat_and_email cloud_connect firepower_4145 teamcenter unified_customer_voice_portal cloud_insights rhythmyx firepower_1140 sipass_integrated siveillance_vantage intersight_virtual_appliance sd-wan_vmanage ucs_central_software contact_center_management_portal webex_meetings_server unified_intelligence_center unified_workforce_optimization energyip_prepay crosswork_zero_touch_provisioning cx_cloud_agent 6bk1602-0aa12-0tp0 unity_connection cloudcenter_workload_manager optical_network_controller virtualized_infrastructure_manager video_surveillance_operations_manager 6bk1602-0aa32-0tp0_firmware unified_communications_manager advanced_malware_protection_virtual_private_cloud_appliance identity_services_engine snow_commander cyber_vision_sensor_management_extension firepower_4112 unified_contact_center_enterprise debian_linux unified_computing_system unified_contact_center_express xpedition_enterprise log4j desigo_cc_advanced_reports ontap_tools unified_communications_manager_im_and_presence_service firepower_2120 mobility_services_engine crosswork_network_automation dna_spaces vesys automated_subsea_tuning cyber_vision siveillance_command evolved_programmable_network_manager dna_spaces\firepower_4110 mendix firepower_4125 sppa-t3000_ses3000 unified_communications_manager_im_\&_presence_service e-car_operation_center nx industrial_edge_management workload_optimization_manager firepower_threat_defense navigator capital crosswork_platform_infrastructure network_services_orchestrator data_center_network_manager crosswork_optimization_engine mindsphere siguard_dsa gma-manager desigo_cc_info_center crosswork_network_controller siveillance_identity Apache Log4j2 Log4j2

CWE ID-CWE-20

Improper Input Validation

CWE ID-CWE-400

Uncontrolled Resource Consumption

CWE ID-CWE-502

Deserialization of Untrusted Data

CWE ID-CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CVE-2023-26592

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs