Input validation error in Intel products - CVE-2025-25210

Vulnerability identifier: #VU122789

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-25210

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within Server Firmware Update Utility(SysFwUpdt). A local administrator can pass specially crafted input to the application and gain elevated privileges on the system.

Intel Server Board M50CYP
Intel Server Board D50TNP
BIOS and System Firmware Update Package (SFUP) for Windows and Linux for Intel Server D50DNP
BIOS and System Firmware Update Package (SFUP) for Windows and Linux for Intel Server M50FCP
Intel Server Firmware Update Utility

Install updates from vendor's website.

Intel Server Board M50CYP - update to R01.01.0010
Intel Server Board D50TNP - update to R01.01.0010
BIOS and System Firmware Update Package (SFUP) for Windows and Linux for Intel Server D50DNP - update to R01.02.0004
BIOS and System Firmware Update Package (SFUP) for Windows and Linux for Intel Server M50FCP - update to R01.02.0004
Intel Server Firmware Update Utility - update to 16.0.12

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01325.html

• Multiple vulnerabilities in Intel Server Firmware Update Utility