Lucene search

[email protected]CVE-2020-24506

HistoryJun 09, 2021 - 7:15 p.m.

CVE-2020-24506

2021-06-0919:15:00

CWE-125

[email protected]

web.nvd.nist.gov

cve-2020-24506

out of bound read

intel csme

information disclosure

local access

security vulnerability

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

6.1 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0005 Low

EPSS

Percentile

16.4%

JSON

Out of bound read in a subsystem in the Intel® CSME versions before 12.0.81, 13.0.47, 13.30.17, 14.1.53 and 14.5.32 may allow a privileged user to potentially enable information disclosure via local access.

CPENameOperatorVersion
intel:converged_security_and_manageability_engineintel converged security and manageability enginelt12.0.81
intel:converged_security_and_manageability_engineintel converged security and manageability enginelt13.0.47
intel:converged_security_and_manageability_engineintel converged security and manageability enginelt13.30.17
intel:converged_security_and_manageability_engineintel converged security and manageability enginelt14.1.53
intel:converged_security_and_manageability_engineintel converged security and manageability enginelt14.5.32
siemens:simatic_field_pg_m6_firmwaresiemens simatic field pg m6 firmwareeq*
siemens:simatic_ipc627e_firmwaresiemens simatic ipc627e firmwarelt25.02.10
siemens:simatic_ipc647e_firmwaresiemens simatic ipc647e firmwarelt25.02.10
siemens:simatic_ipc677e_firmwaresiemens simatic ipc677e firmwarelt25.02.10
siemens:simatic_ipc847e_firmwaresiemens simatic ipc847e firmwarelt25.02.10

CPE	Name	Operator	Version
intel:converged_security_and_manageability_engine	intel converged security and manageability engine	lt	12.0.81
intel:converged_security_and_manageability_engine	intel converged security and manageability engine	lt	13.0.47
intel:converged_security_and_manageability_engine	intel converged security and manageability engine	lt	13.30.17
intel:converged_security_and_manageability_engine	intel converged security and manageability engine	lt	14.1.53
intel:converged_security_and_manageability_engine	intel converged security and manageability engine	lt	14.5.32
siemens:simatic_field_pg_m6_firmware	siemens simatic field pg m6 firmware	eq	*
siemens:simatic_ipc627e_firmware	siemens simatic ipc627e firmware	lt	25.02.10
siemens:simatic_ipc647e_firmware	siemens simatic ipc647e firmware	lt	25.02.10
siemens:simatic_ipc677e_firmware	siemens simatic ipc677e firmware	lt	25.02.10
siemens:simatic_ipc847e_firmware	siemens simatic ipc847e firmware	lt	25.02.10

References

cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf

security.netapp.com/advisory/ntap-20210611-0004/

www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

6.1 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0005 Low

EPSS

Percentile

16.4%

JSON

Related for CVE-2020-24506

prion1 cvelist1 lenovo1 hp1 intel1 ics1