medium6.8
CVE-2020-8745
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.2…
Impact
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Intel | Converged Security And Manageability Engine | before 11.8.80 from 11.12.0 before 11.12.80 from 11.22.0 before 11.22.80 from 12.0 before 12.0.70 from 14.0 before 14.0.45 from 14.5.0 before 14.5.25 |
| Intel | Trusted Execution Technology | before 3.1.80 from 4.0 before 4.0.30 |
| Siemens | Simatic Drive Controller Firmware | before 05.00.01.00 |
| Siemens | Simatic Et200sp 1515sp Pc2 Firmware | before 0209.0105 |
| Siemens | Simatic Field Pg M5 Firmware | before 22.01.08 |
| Siemens | Simatic Field Pg M6 Firmware | All versions |
| Siemens | Simatic Ipc127e Firmware | before 27.01.05 |
| Siemens | Simatic Ipc427e Firmware | before 27.01.05 |
| Siemens | Simatic Ipc477e Firmware | before 21.01.15 |
| Siemens | Simatic Ipc527g Firmware | before 1.4.0 |
| Siemens | Simatic Ipc547g Firmware | before r1.30.0 |
| Siemens | Simatic Ipc627e Firmware | before 25.02.08 |
References
- NVD record
- CVE.org record
- https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf
- https://security.netapp.com/advisory/ntap-20201113-0002/
- https://security.netapp.com/advisory/ntap-20201113-0005/
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391
- https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf
- https://security.netapp.com/advisory/ntap-20201113-0002/
- https://security.netapp.com/advisory/ntap-20201113-0005/
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391