CVE-2022-36348 Privilege escalation in Intel (R) SPS firmware
Active debug code in Intel SPS firmware allows authenticated local users to escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-36348?
CVE-2022-36348 is a high-severity vulnerability in Intel (R) SPS firmware, published on 16 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Active debug code in some Intel (R) SPS firmware before version SPS_E5_04.04.04.300.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Which versions are affected by CVE-2022-36348?
It affects 1 product.
Products include Intel Server Platform Services.
How do I fix CVE-2022-36348?
No fix has been published for CVE-2022-36348 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-36348 being exploited?
There is no known exploitation of CVE-2022-36348 in the wild and no public exploit code.
Other vulnerabilities in Intel (R) SPS firmware
- CVE-2020-0586 Privilege escalation in Intel(R) SPS
- CVE-2020-24509 Privilege escalation in Intel(R) SPS versions
- CVE-2019-0089 Privilege escalation in Intel(R) Server Platform Services (SPS)
- CVE-2022-36794 Denial of service in Intel(R) SPS firmware
- CVE-2023-29153 Denial of service in Intel(R) SPS firmware
Sources
Also known as GHSA-rgfq-fxxv-9cxw.