CVE Vulnerability

CVE-2018-3643

A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55, 11.21.55, 12.0.6 or Intel(R) Server Platform Services firmware before version 4.x.04 may allow an attacker with administrative privileges to uncover certain platform secrets via local access or to potentially execute arbitrary code.

4.6 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

8.2 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00131.html Vendor Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03873en_us Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20180924-0002/ Third Party Advisory
Configurations

Configuration 1

cpe:2.3:o:intel:server_platform_services_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:intel:converged_security_management_engine_firmware:*:*:*:*:*:*:*:*
Information

Published : 2018-09-12 07:29

Updated : 2019-10-03 12:03

NVD link : CVE-2018-3643

Mitre link : CVE-2018-3643

Products Affected
No products.
CWE
NVD-CWE-noinfo