CVE-2022-36374

2023-11-1419:15:12

CWE-284

[email protected]

web.nvd.nist.gov

cve-2022-36374

intel

aptio

uefi firmware

access control

privilege escalation

7.5 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.1%

JSON

Improper access control in some Intel® Aptio* V UEFI Firmware Integrator Tools before version iDmi Windows 5.27.03.0003 may allow a privileged user to potentially enable escalation of privilege via local access.

Affected configurations

NVD

Node

intelaptio_v_uefi_firmware_integrator_toolsMatch5.27.03.0003

AND

microsoftwindowsMatch-

Node

intelaptio_v_uefi_firmware_integrator_toolsMatch5.27.06.0017

AND

linuxlinux_kernelMatch-

CPENameOperatorVersion
intel:aptio_v_uefi_firmware_integrator_toolsintel aptio v uefi firmware integrator toolseq5.27.03.0003

CPE	Name	Operator	Version
intel:aptio_v_uefi_firmware_integrator_tools	intel aptio v uefi firmware integrator tools	eq	5.27.03.0003

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Intel(R) Aptio* V UEFI Firmware Integrator Tools",
    "versions": [
      {
        "version": "before version iDmi Windows 5.27.03.0003",
        "status": "affected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]