Multiple vulnerabilities in Intel Server Configuration Utility Software Installer

Published: 2023-11-23

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2023-25075 CVE-2023-34997
CWE-ID	CWE-426 CWE-277
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	Intel Server Configuration Utility Hardware solutions / Firmware
Vendor

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Untrusted search path

EUVDB-ID: #VU83446

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-25075

CWE-ID: CWE-426 - Untrusted Search Path

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an untrusted search path in the installer. A local user can execute arbitrary code with escalated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intel Server Configuration Utility: before 16.0.9

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00925.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Insecure Inherited Permissions

EUVDB-ID: #VU83448