PT-2019-3266 · Intel · Intel Compute Stick+3

Dmitry Frolov · Published 2019-08-13 · Updated 2019-08-27 · CVE-2019-11140

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Intel NUC (affected versions not specified) Intel NUC Kit (affected versions not specified) Intel Compute Stick (affected versions not specified) Intel Compute Card (affected versions not specified)

Description The issue is related to insufficient session validation in system firmware, which may allow a privileged user to potentially enable escalation of privilege, denial of service, and/or information disclosure via local access. It is also described as a vulnerability due to insufficient input validation, which can be exploited by an attacker to gain elevated privileges, disclose protected information, or cause a denial of service.

Recommendations For Intel NUC, consider restricting local access to minimize the risk of exploitation until a fix is available. For Intel NUC Kit, avoid using the system until a patch or fix is provided to address the insufficient input validation. For Intel Compute Stick, as a temporary workaround, consider disabling local access to prevent potential exploitation. For Intel Compute Card, restrict access to sensitive information and functions to minimize the risk of information disclosure or privilege escalation until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-03288

CVE-2019-11140

Affected Products

Intel Compute Card

Intel Compute Stick

Intel Nuc

Intel Nuc Kit

References · 3

• https://bdu.fstec.ru/vul/2019-03288 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-11140 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00272.html · Vendor Advisory