PT-2019-1667 · Intel · Intel Txe+1

Published 2019-03-12 · Updated 2019-03-21 · CVE-2018-12188

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Intel CSME versions prior to 11.8.60, 11.11.60, 11.22.60 or 12.0.20 Intel TXE versions prior to 3.1.60 or 4.0.10

Description The issue is related to insufficient input validation in Intel Converged Security and Manageability Engine and Trusted Execution Engine. This could allow an unauthenticated user to potentially modify data via physical access, thereby gaining access to protected information.

Recommendations For Intel CSME versions prior to 11.8.60, 11.11.60, 11.22.60 or 12.0.20, update to version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or later. For Intel TXE versions prior to 3.1.60 or 4.0.10, update to version 3.1.60 or 4.0.10 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-01215

CVE-2018-12188

Affected Products

Intel Csme

Intel Txe

References · 6

• https://osv.dev/vulnerability/CVE-2018-12188 · Vendor Advisory
• https://intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12188 · Security Note
• https://bdu.fstec.ru/vul/2019-01215 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00185.html · Note
• https://security.netapp.com/advisory/ntap-20190318-0001 · Note