CVE-2023-22444 Information disclosure in Intel(R) NUC 13 Extreme Compute Element, Intel(R) NUC 13 Extreme Kit, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Performance Mini PC, Intel(R) NUC Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board and Intel(R) NUC Pro Mini PC BIOS firmware
A privileged local attacker can exploit improper BIOS initialization to disclose sensitive information on Intel NUC devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22444?
CVE-2023-22444 is a medium-severity vulnerability in Intel(R) NUC 13 Extreme Compute Element, Intel(R) NUC 13 Extreme Kit, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Performance Mini PC, Intel(R) NUC Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board and Intel(R) NUC Pro Mini PC BIOS firmware, published on 11 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper initialization in some Intel(R) NUC 13 Extreme Compute Element, Intel(R) NUC 13 Extreme Kit, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Performance Mini PC, Intel(R) NUC Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board and Intel(R) NUC Pro Mini PC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access.
Weakness: CWE-665
Which versions are affected by CVE-2023-22444?
It affects 111 products.
Products include Intel Nuc 11 Compute Element Cm11ebc4w Firmware, Intel Nuc 11 Compute Element Cm11ebi38w Firmware, Intel Nuc 11 Compute Element Cm11ebi58w Firmware, Intel Nuc 11 Compute Element Cm11ebi716w Firmware, Intel Nuc 11 Enthusiast Kit Nuc11phki7c Firmware, Intel Nuc 11 Enthusiast Mini Pc Nuc11phki7caa Firmware and 105 more.
How do I fix CVE-2023-22444?
No fix has been published for CVE-2023-22444 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-22444 being exploited?
There is no known exploitation of CVE-2023-22444 in the wild and no public exploit code.
Other vulnerabilities in Intel(R) NUC 13 Extreme Compute Element, Intel(R) NUC 13 Extreme Kit, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Performance Mini PC, Intel(R) NUC Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board and Intel(R) NUC Pro Mini PC BIOS firmware
Sources
Also known as GHSA-jppm-rmh2-mpxw.