PT-2022-2967 · Intel · Intel Amt Sdk+2

Dan Horovitz · Published 2022-02-08 · Updated 2022-07-28 · CVE-2021-33107

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Intel(R) AMT SDK versions prior to 16.0.3 Intel(R) SCS versions prior to 12.2 Intel(R) MEBx versions prior to 11.0.0.0012, 12.0.0.0011, 14.0.0.0004, and 15.0.0.0004

Description The issue is related to insufficiently protected credentials in USB provisioning for Intel(R) AMT SDK, Intel(R) SCS, and Intel(R) MEBx. This may allow an unauthenticated user to potentially enable information disclosure via physical access.

Recommendations For Intel(R) AMT SDK versions prior to 16.0.3, update to version 16.0.3 or later. For Intel(R) SCS versions prior to 12.2, update to version 12.2 or later. For Intel(R) MEBx versions prior to 11.0.0.0012, 12.0.0.0011, 14.0.0.0004, and 15.0.0.0004, update to a version that includes the necessary security fixes. As a temporary workaround, consider restricting physical access to the affected systems until a patch is available.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2022-03595

CVE-2021-33107

Affected Products

Intel Amt Sdk

Intel Mebx

Intel Scs

References · 7

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00575.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33107 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00601.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33107 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03595 · Security Note
• https://t.me/cvenotify/33895 · Telegram Post
• https://t.me/cibsecurity/37186 · Telegram Post