« Volver al listado

CVE-2018-12190

Estado: ModificadaMedia (6.7)—

Insufficient input validation in Intel(r) CSME subsystem before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel(r) TXE before 3.1.60 or 4.0.10 may allow a privileged user to potentially enable an escalation of privilege via local access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Intel — Converged Security Management Engine FirmwareIntel — Trusted Execution Engine Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-12190",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@intel.com",
      "affectedData": [
        {
          "vendor": "Intel Corporation",
          "product": "Intel(R) CSME, Server Platform Services, Trusted Execution Engine and Intel(R) Active Management Technology",
          "versions": [
            {
              "status": "affected",
              "version": "Multiple versions."
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-14T20:29:00.427",
  "references": [
    {
      "url": "https://security.netapp.com/advisory/ntap-20190318-0001/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20190318-0001/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient input validation in Intel(r) CSME subsystem before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel(r) TXE before 3.1.60 or 4.0.10 may allow a privileged user to potentially enable an escalation of privilege via local access."
    },
    {
      "lang": "es",
      "value": "Una validación de entrada insuficiente en el subsistema Intel(r) CSME en las versiones anteriores a la 11.8.60, 11.11.60, 11.22.60 o 12.0.20 o Intel(r) TXE en las versiones anteriores a la 3.1.60 o 4.0.10 puede permitir a un usuario con privilegios una escalada de privilegios a través del acceso local."
    }
  ],
  "lastModified": "2026-06-17T01:37:17.563",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:intel:converged_security_management_engine_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89FAC2D9-E921-4F45-B786-0902B310C2A3",
              "versionEndExcluding": "11.8.60",
              "versionStartIncluding": "11.0"
            },
            {
              "criteria": "cpe:2.3:o:intel:converged_security_management_engine_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB85F0E9-95F9-452C-AAAF-0C8CCCE76C59",
              "versionEndExcluding": "11.11.60",
              "versionStartIncluding": "11.10"
            },
            {
              "criteria": "cpe:2.3:o:intel:converged_security_management_engine_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A44D8E6-445C-475D-BB1A-75C03AEE940B",
              "versionEndExcluding": "11.22.60",
              "versionStartIncluding": "11.20"
            },
            {
              "criteria": "cpe:2.3:o:intel:converged_security_management_engine_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91671FB7-F021-4781-9CBD-E7B66727B747",
              "versionEndExcluding": "12.0.20",
              "versionStartIncluding": "12.0.0"
            },
            {
              "criteria": "cpe:2.3:o:intel:trusted_execution_engine_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3029FF22-3BD0-41A7-BBF9-E6183DF2BD31",
              "versionEndExcluding": "3.1.60",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:o:intel:trusted_execution_engine_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "916A348F-144A-4A81-B93F-D3422A662D09",
              "versionEndExcluding": "4.0.10",
              "versionStartIncluding": "4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@intel.com"
}