CVE-2019-0086

CVE-2019-0086 is an insufficient access control vulnerability in Intel CSME/DAL and TXE that could let an unprivileged local user escalate privileges. Affected: Intel CSME before 11.8.65/11.11.65/11.22.65, 12.0.35 and Intel TXE 3.1.65, 4.0.15. Impact: local privilege escalation; exploitation requ...

CVE-2019-0170

CVE-2019-0170 describes a buffer overflow in Intel® Dynamic Application Loader (DAL) within Intel® CSME/DAL, allowing a privileged local attacker to potentially escalate privileges. Affected: DAL subsystem in Intel® CSME (and related DAL/AMT stack) up to version 12.0.34; vulnerability arises from...

CVE-2019-0153

CVE-2019-0153 is an Intel CSME buffer overflow vulnerability affecting CSME 12.0.0–12.0.34. An unauthenticated, remote attacker could potentially escalate privileges via network access. The strongest documented impact is privilege escalation with high/critical impact in CVSS terms (CVSSv3 base sc...

CVE-2018-3616

CVE-2018-3616 is a Bleichenbacher-style side-channel vulnerability in the TLS implementation of Intel AMT/CSME firmware prior to 12.0.5. An unauthenticated attacker could potentially obtain the TLS session key over the network. Public-internal sources confirm impact on Intel AMT/CSME (TLS) with C...

CVE-2019-0098

CVE-2019-0098 is a logic bug in Intel CSME (before 12.0.35) and TXE (before 3.1.65, 4.0.15) that may allow an unauthenticated user to escalate privileges via physical access. Connected docs corroborate affected Intel subsystems (CSME, SPS, TXE, DAL, AMT) and note mitigation paths: Intel’s advisor...

CVE-2019-0168

CVE-2019-0168 affects Intel CSME and TXE subsystems (also involving AMT/SPS/DAL) due to insufficient input validation in the subsystem. The issue potentially allows a privileged user to escalate privileges or disclose information via local access. Fixes exist: Intel/partners list updated firmware...

CVE-2019-14598

CVE-2019-14598 describes an Improper Authentication issue in Intel CSME subsystems that could allow a locally authenticated attacker to escalate privileges, cause denial of service, or disclose information. Affected firmware ranges include 12.x (12.0–12.0.48; IoT 12.0.56), 13.x (up to 13.0.20), a...

CVE-2018-3658

CVE-2018-3658 affects Intel AMT in Intel CSME firmware prior to 12.0.5. The issue is described as multiple memory leaks that may allow an unauthenticated, Intel AMT-provisioned user to cause a partial denial of service over the network. Remediation: upgrade to the latest Intel CSME firmware versi...

CVE-2019-11103

CVE-2019-11103 involves insufficient input validation in Intel CSME firmware/update software. The issue can let an authenticated, locally located user potentially escalate privileges via the firmware/update subsystem. Affected are Intel CSME/AMT/DAL components with vulnerable firmware before 12.0...

CVE-2019-11147

CVE-2019-11147 involvesInsufficient access control in the Intel CSME hardware abstraction driver (MEInfo) and related TXE/Detection Tool components, potentially allowing an authenticated user to escalate privileges via local access. Red Hat and CVE records describe the same issue and list affecte...

CVE-2019-11106

CVE-2019-11106 affects Intel CSME, TXE, AMT and related components. The issue is insufficient session validation in Intel CSME subsystems (and related TXE/AMT subsystems), potentially allowing a local attacker to escalate privileges. Affects CSME versions prior to 11.8.70, 12.0.45, 13.0.10 and 14...

CVE-2018-3657

CVE-2018-3657 affects Intel AMT in Intel CSME firmware prior to 12.0.5, enabling a local attacker with high privileges to potentially execute arbitrary code with AMT execution rights via local access. The issue is described across multiple sources (NVD entry and related advisories) with a CVSSv3 ...

CVE-2019-0169

CVE-2019-0169 is a hardware/firmware vulnerability affecting Intel CSME and TXE subsystems (and related Intel AMT/SPS/DAL components). The issue is a heap overflow in the CSME/TXE subsystems that may allow an unauthenticated user to escalate privileges, disclose information, or cause a denial of ...

CVE-2019-0165

CVE-2019-0165 concerns Intel CSME: Insufficient input validation in the subsystem before versions 12.0.45, 13.0.10, and 14.0.10 may allow a privileged user to potentially trigger a denial of service via local access. Connected sources corroborate this behavior across Intel CSME/AMT/SPS/TXE/DAL co...

CVE-2019-11105

CVE-2019-11105 describes a logic issue in the Intel CSME subsystem that may allow a privileged local attacker to escalate privileges and disclose information on affected systems. Affected are Intel CSME before versions 12.0.45, 13.0.10, and 14.0.10. The Red Hat and CVE ecosystems corroborate a lo...

CVE-2019-11104

CVE-2019-11104 concerns Intel CSME MEInfo and Intel TXE. Insufficient input validation in MEInfo before 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; and in TXE before 3.1.70 and 4.0.20, may allow an authenticated user to escalate privileges via local access. Related Red Hat/Lenovo e...

CVE-2019-11101

CVE-2019-11101 involves insufficient input validation in the Intel CSME and TXE subsystems (and related AMT/DAL components). Affected are Intel CSME before 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10, 14.0.10 and Intel TXE before 3.1.70 and 4.0.20. The issue may allow a privileged user to discl...

CVE-2019-11110

CVE-2019-11110 is an authentication bypass affecting Intel CSME and TXE subsystems. Public sources (Intel advisory and Red Hat/Lenovo summaries) describe: Affects Intel CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10, 14.0.10 and Intel TXE before versions 3.1.70 and 4.0.20. Pri...

CVE-2019-11108

CVE-2019-11108 affects Intel CSME subsystem before 12.0.45 and 13.0.10, enabling local privilege escalation. Affected components include Intel CSME/AMT/TXE (and related firmware tooling); exploitation is local. Remediation: upgrade to Intel CSME 12.0.45 or newer or 13.0.10 or newer (per Intel/EU/...

CVE-2019-11087

This CVE affects Intel CSME, AMT, SPS, TXE and related DAL components. Root cause: insufficient input validation in the Intel CSME/TXE subsystems. Affected versions include Intel CSME before 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel TXE before 3.1.70 and 4.0.20. Conditions ...

CVE-2020-0541

CVE-2020-0541 describes an out-of-bounds write in the Intel® CSME subsystem. Affected versions are Intel CSME before 12.0.64, 13.0.32, 14.0.33 and 14.5.12, which may allow a privileged user to escalate privileges via local access. The vulnerability is part of Intel’s broader INTEL-SA-00295 set of...

CVE-2020-0545

CVE-2020-0545 describes an integer overflow in the Intel CSME subsystem (and related SPS/TXE/AMT components) that may allow a privileged local attacker to cause a denial of service. Affected are Intel CSME versions before 11.8.77, 11.12.77, 11.22.77; Intel TXE before 3.1.75 and 4.0.25; and SPS fi...

CVE-2020-0534

CVE-2020-0534: Intel CSME DAL subsystem has improper input validation in CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12, which may allow an unauthenticated user to cause denial of service over network access. Connected sources (Intel INTEL-SA-00295 advisory, NVD entry, and Lenovo/HP a...

CVE-2020-0542

CVE-2020-0542 concerns Intel CSME: Improper buffer restrictions in the subsystem affect Intel CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12, potentially enabling escalation of privileges, information disclosure, or denial of service via local access for authenticated users. Connected...

CVE-2022-36392

CVE-2022-36392 : Intel reports an improper input validation flaw in firmware for Intel® AMT, Intel® Converged Security and Manageability Engine (CSME), and Intel® Standard Manageability. The issue could allow an unauthenticated attacker to trigger a denial of service over network access. Affected...

CVE-2020-0539

CVE-2020-0539 describes a path traversal vulnerability in Intel CSME/DAL subsystems (and related TXE) that may allow an unprivileged local user to cause denial of service. Affected are Intel CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33 and Intel TXE versions before ...

CVE-2020-0533

CVE-2020-0533 affects Intel CSME in versions before 11.8.76, 11.12.77, and 11.22.77. The issue is a reversible one-way hash that may allow a privileged user to escalate privileges, cause a DoS, or disclose information via local access. Intel (and Lenovo/HP advisories) indicate updates are availab...

CVE-2018-12147

CVE-2018-12147 affects Intel CSME (HECI) subsystem, Intel SPS, and TXE firmware. The issue is insufficient input validation that may allow a privileged user to escalate local privileges. Vulnerable states are Intel CSME before 11.21.55, SPS before 4.0 (Purley/Bakerville), and TXE firmware before ...

CVE-2020-0536

CVE-2020-0536 affects Intel CSME DAL subsystem and Intel TXE: improper input validation may allow an unauthenticated network-access information disclosure. Affected versions are CSME before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33 and TXE before 3.1.75 and 4.0.25. Intel and Lenovo a...

CVE-2022-29871

CVE-2022-29871 : Improper access control in the Intel® CSME software installer before version 2306.4.10.0 may allow an authenticated user to escalate privileges via local access. Documented impact: local escalation with high confidentiality/integrity/availability implications. Affected Intel CSME...

CVE-2018-3643

CVE-2018-3643 concerns a vulnerability in Intel Power Management Controller (PMC) firmware affecting systems with Intel CSME before 11.8.55, 11.11.55, 11.21.55, or 12.0.6, and Intel Server Platform Services (SPS) firmware before 4.x.04. The flaw could allow an attacker with administrative privile...

CVE-2022-38102

CVE-2022-38102 involves improper input validation in Intel® Converged Security and Management Engine (CSME) firmware before versions 15.0.45 and 16.1.27, which may allow a privileged user to cause a denial of service via local access. Affected products include Intel® CSME/AMT/Standard Manageabili...

CVE-2018-12191

The CVE-2018-12191 issue affects Intel CSME, Intel Server Platform Services (SPS), and Intel TXE/AMT. It is a bounds-check vulnerability in the Kernel subsystem that could allow an unauthenticated user with physical access to potentially execute arbitrary code. Affected versions are: Intel CSME b...

CVE-2018-3659

CVE-2018-3659 affects Intel PTT in Intel CSME firmware prior to 12.0.5 and TXE firmware prior to 4.0, allowing potential information disclosure with physical access. Affected products include Intel CSME and TXE implementations; root cause is in the PTT module itself. Mitigation is to update to th...

CVE-2018-12190

CVE-2018-12190 affects Intel CSME, Server Platform Services, TXE and AMT. The issue is insufficient input validation in Intel CSME subsystem (before 11.8.60, 11.11.60, 11.22.60 or 12.0.20) or Intel TXE (before 3.1.60 or 4.0.10) that may allow a privileged user to escalate privileges via local acc...

CVE-2018-12192

The CVE-2018-12192 issue is a logic bug in the Kernel subsystem of Intel CSME and related components (SPS, TXE, AMT) that may allow an unauthenticated user to bypass MEBx authentication via physical access. Affected products include Intel CSME, SPS, TXE, and AMT with affected firmware ranges cite...

CVE-2018-3627

CVE-2018-3627 is a logic bug in Intel’s Converged Security Management Engine (CSME) 11.x firmware that could allow an attacker with local privileged access to execute arbitrary code. The vulnerability affects Intel CSME 11.x on several generations of Intel CPUs and is described as a local-elevati...

CVE-2018-12185

The CVE-2018-12185 entry corresponds toInsufficient input validation in Intel AMT through Intel CSME prior to 11.8.60/11.11.60/11.22.60 or 12.0.20, allowing an unauthenticated attacker with physical access to potentially execute arbitrary code. Connected Intel advisory INTEL-SA-00185 and Lenovo L...

CVE-2018-3655

The CVE-2018-3655 issue affects Intel CSME firmware before 11.21.55, Intel SPS before 4.0, and Intel TXE firmware before 3.1.55. The vulnerability allows an unauthenticated user with physical access to potentially modify or disclose information stored in the CSME/SPS/TXE subsystems. Exploitation ...

CVE-2018-12189

The CVE-2018-12189 issue affects Intel CSME (and related TXE) with an unhandled exception in the Content Protection subsystem that may allow a privileged local user to modify data. Affected firmware ranges include CSME pre-11.8.60 / 11.11.60 / 11.22.60 / 12.0.20 and TXE before 3.1.60 or 4.0.10. I...

CVE-2018-12196

CVE-2018-12196: Insufficient input validation in Intel AMT within Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow a privileged user to execute arbitrary code via local access. The Intel advisory INTEL-SA-00185 details broader issues affecting Intel CSME, SPS, TXE, and ...

CVE-2018-12199

CVE-2018-12199 is a buffer overflow in Intel CSME/TXE components that could let a privileged user execute arbitrary code with physical access. The affected software ranges include Intel CSME before 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel TXE before 3.1.60 or 4.0.10. Intel’s advisory (INT...

CVE-2018-12188

CVE-2018-12188: In Intel CSME (and related TXE/AMS components) there is insufficient input validation prior to specific firmware versions (CSME <11.8.60/11.11.60/11.22.60/12.0.20; TXE

CVE-2018-12208

Intel CVE-2018-12208 is a buffer overflow in the HECI subsystem affecting Intel CSME, TXE, and SPS prior to specified fixed versions. The Intel advisory INTEL-SA-00185 documents the issue, listing affected products and firmware families (CSME before 11.8.60/11.11.60/11.22.60 or 12.0.20; TXE befor...