CVE-2023-32285 Missing authorization in Intel(R) NUC BIOS firmware
A privileged local user can cause a denial of service in Intel NUC BIOS firmware due to improper access control.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32285?
CVE-2023-32285 is a medium-severity missing authorization vulnerability in Intel(R) NUC BIOS firmware, published on 11 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper access control in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of service via local access.
Weakness: CWE-284
Which versions are affected by CVE-2023-32285?
It affects 67 products.
Products include Intel Compute Element Stk2mv64cc Firmware, Intel Nuc Board Nuc7i3bnb Firmware, Intel Nuc Board Nuc7i3bnh Firmware, Intel Nuc Board Nuc7i3bnhx1 Firmware, Intel Nuc Board Nuc7i3bnhxf Firmware, Intel Nuc Board Nuc7i3bnk Firmware and 61 more.
How do I fix CVE-2023-32285?
No fix has been published for CVE-2023-32285 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-32285 being exploited?
There is no known exploitation of CVE-2023-32285 in the wild and no public exploit code.
Other vulnerabilities in Intel(R) NUC BIOS firmware
Sources
Also known as GHSA-pv89-6rhc-rjpx.