PT-2018-2697 · Intel · Intel Nuc

Publicado 2018-10-09 · Atualizado 2019-10-03 · CVE-2018-12158

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Intel NUC FW kits versions prior to May 24, 2018

Description The issue is related to insufficient input validation in the BIOS update utility, which may allow a privileged user to trigger a denial of service or information disclosure via local access. This could potentially be exploited to disrupt service or reveal protected information.

Recommendations For Intel NUC FW kits versions prior to May 24, 2018, update the BIOS to a version released after May 24, 2018 to resolve the issue. As a temporary workaround, consider restricting local access to the BIOS update utility to minimize the risk of exploitation.

Correção

RCE

Information Disclosure

Enumeração de Fraquezas

CWE-20

CWE-200

Identificadores relacionados

BDU:2019-01380

CVE-2018-12158

Produtos afetados

Intel Nuc

Referências · 4

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00168.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-12158 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01380 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-12158 · Nota de Segurança