CVE-2020-0536 Information disclosure in Intel(R) CSME
An unauthenticated attacker can exploit improper input validation in Intel CSME to disclose sensitive information via network access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-0536?
CVE-2020-0536 is a high-severity vulnerability in Intel(R) CSME, published on 15 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and Intel(R) TXE versions before 3.1.75 and 4.0.25 may allow an unauthenticated user to potentially enable information disclosure via network access.
Weakness: CWE-20
Which versions are affected by CVE-2020-0536?
It affects 2 products.
Products include Intel Converged Security Management Engine Firmware, Intel Trusted Execution Engine Firmware.
How do I fix CVE-2020-0536?
No fix has been published for CVE-2020-0536 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-0536 being exploited?
There is no known exploitation of CVE-2020-0536 in the wild and no public exploit code.
Other vulnerabilities in Intel(R) CSME
- CVE-2019-0153 Memory corruption in Intel(R) Converged Security & Management Engine (CSME)
- CVE-2019-0169 Memory corruption in Intel(R) TXE
- CVE-2022-36392 Denial of service in Intel(R) AMT and Intel(R) Standard Manageability in Intel (R) CSME
- CVE-2018-3643 Information disclosure in Intel(R) Converged Security and Management Engine (CSME) and Intel(R) Server Platform Services firmware
- CVE-2018-3627 Privilege escalation in Intel Converged Security Management Engine (Intel CSME)
Sources
Also known as GHSA-f3hr-4gx3-x2mg.