PT-2021-2099 · Intel · Intel Ethernet I210 Controller

Published 2021-02-09 · Updated 2021-02-22 · CVE-2020-0524

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Intel(R) Ethernet I210 Controller series of network adapters versions prior to 3.30

Description: The issue is related to improper default permissions in the firmware, which may allow an authenticated user to potentially enable denial of service via local access. This could be exploited by an attacker to cause a disruption in service.

Recommendations: For versions prior to 3.30, update the firmware to version 3.30 or later to resolve the issue. As a temporary workaround, consider restricting local access to the network adapters to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2021-00953

CVE-2020-0524

Affected Products

Intel Ethernet I210 Controller

References · 7

• https://osv.dev/vulnerability/CVE-2020-0524 · Vendor Advisory
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00318.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0524 · Security Note
• https://bdu.fstec.ru/vul/2021-00953 · Security Note
• https://t.me/cvenotify/10060 · Telegram Post
• https://t.me/cvenotify/10064 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021021007 · Note