CVE-2018-12172 Weak cryptography in Intel Server Board
A privileged local attacker can disclose firmware passwords due to improper hashing in Intel Server Board firmware.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-12172?
CVE-2018-12172 is a medium-severity vulnerability in Intel Server Board, published on 10 Oct 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper password hashing in firmware in Intel Server Board (S7200AP,S7200APR) and Intel Compute Module (HNS7200AP, HNS7200AP) may allow a privileged user to potentially disclose firmware passwords via local access.
Which versions are affected by CVE-2018-12172?
It affects 4 products.
Products include Intel Hns7200ap Firmware, Intel Hns7200apr Firmware, Intel S7200ap Firmware, Intel S7200apr Firmware.
How do I fix CVE-2018-12172?
No fix has been published for CVE-2018-12172 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-12172 being exploited?
There is no known exploitation of CVE-2018-12172 in the wild and no public exploit code.
Sources
Also known as GHSA-g4vv-hh36-2q9r.