CVE-2018-12169 Auth bypass in n/a

What is CVE-2018-12169?

CVE-2018-12169 is a high-severity authentication bypass vulnerability in n/a, published on 21 Sep 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Processor, 7th Generation Intel Core Processor and 8th Generation Intel Core Processor contains a logic error which may allow physical attacker to potentially bypass firmware authentication.

Weakness: CWE-287

Which versions are affected by CVE-2018-12169?

It affects 32 products.

Products include Intel Core I3, Intel Core I5, Intel Core I7, Intel Core I9, Lenovo Thinkpad 11e, Lenovo Thinkpad E480 and 26 more.

How do I fix CVE-2018-12169?

No fix has been published for CVE-2018-12169 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-12169 being exploited?

There is no known exploitation of CVE-2018-12169 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-3615 Information disclosure in Multiple High 7.3
• CVE-2017-5704 Information disclosure in Intel Core Processor Medium 6.7
• CVE-2018-3620 Information disclosure in Multiple Medium 5.6
• CVE-2018-3646 Information disclosure in Multiple Medium 5.6
• CVE-2018-3619 Information disclosure in Intel Optane memory Medium 4.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7hjg-jw54-wcj9.