Main Vulnerability Database Vulnerabilities #VU45726

Input validation error in Intel products - CVE-2020-12299

Published: August 14, 2020

Vulnerability identifier: #VU45726

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12299

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in BIOS firmware. A local administrator can pass specially crafted input to the application and gain elevated privileges on the target system.

Affected software

Intel Server Board S2600ST
Intel Server Board S2600BP
Intel Server Board S2600WF

How to mitigate CVE-2020-12299

Install updates from vendor's website.

Intel Server Board S2600ST - update to 02.01.0011
Intel Server Board S2600BP - update to 02.01.0011
Intel Server Board S2600WF - update to 02.01.0011

External References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00367.html

Related Security Bulletins