PT-2018-2697 · Intel · Intel Nuc

Published 2018-10-09 · Updated 2019-10-03 · CVE-2018-12158

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Intel NUC FW kits versions prior to May 24, 2018

Description The issue is related to insufficient input validation in the BIOS update utility, which may allow a privileged user to trigger a denial of service or information disclosure via local access. This could potentially be exploited to disrupt service or reveal protected information.

Recommendations For Intel NUC FW kits versions prior to May 24, 2018, update the BIOS to a version released after May 24, 2018 to resolve the issue. As a temporary workaround, consider restricting local access to the BIOS update utility to minimize the risk of exploitation.

Fix

RCE

Information Disclosure

Weakness Enumeration

CWE-20

CWE-200

Related Identifiers

BDU:2019-01380

CVE-2018-12158

Affected Products

Intel Nuc

References · 4

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00168.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12158 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01380 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-12158 · Security Note