CVE-2021-33107 Hardcoded credentials in Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and Intel(R) MEBx
Unauthenticated users with physical access can disclose information due to insufficiently protected credentials in Intel AMT SDK USB provisioning.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-33107?
CVE-2021-33107 is a medium-severity vulnerability in Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and Intel(R) MEBx, published on 9 Feb 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and Intel(R) MEBx before versions 11.0.0.0012, 12.0.0.0011, 14.0.0.0004 and 15.0.0.0004 may allow an unauthenticated user to potentially enable information disclosure via physical access.
Weakness: CWE-522
Which versions are affected by CVE-2021-33107?
It affects 180 products.
Products include Intel Active Management Technology Software Development Kit, Intel Core I3-1000g1 Firmware, Intel Core I3-1000g4 Firmware, Intel Core I3-1000ng4 Firmware, Intel Core I3-1005g1 Firmware, Intel Core I3-10100 Firmware and 174 more.
How do I fix CVE-2021-33107?
No fix has been published for CVE-2021-33107 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-33107 being exploited?
There is no known exploitation of CVE-2021-33107 in the wild and no public exploit code.
Other vulnerabilities in Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and Intel(R) MEBx
Sources
Also known as GHSA-343q-2m8h-67wf.