CVE-2017-5689 Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation
Unprivileged attackers can bypass authentication to gain system privileges on Intel manageability firmware, requiring immediate patching.
- Exploited in the wild
- Since 28 Jan 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-5689?
CVE-2017-5689 is a critical authentication bypass vulnerability in Intel Active Management Technology Firmware, published on 2 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
Weakness: CWE-269
Which versions are affected by CVE-2017-5689?
It affects 36 products.
Products include Hpe Proliant Ml10 Gen9 Server Firmware, Intel Active Management Technology Firmware, Siemens Simatic Field Pg M3 Firmware, Siemens Simatic Field Pg M4 Firmware, Siemens Simatic Field Pg M5 Firmware, Siemens Simatic Ipc427d Firmware and 30 more.
How do I fix CVE-2017-5689?
No fix has been published for CVE-2017-5689 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Jul 2022.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-5689 being exploited?
Yes. Attackers have exploited CVE-2017-5689 in the wild since at least 28 Jan 2022.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 6 proofs of concept on GitHub.
Sources
Also known as GHSA-v6j9-wwcx-4984.