Use of hard-coded cryptographic key in Intel products - CVE-2020-12376

Vulnerability identifier: #VU50602

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2020-12376

CWE-ID: CWE-321

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: Intel

Affected software:
Intel Server System R1000WF
Intel Server System R2000WF
Intel Server Board S2600WF
Intel Server Board S2600ST
Intel Compute Module HNS2600BP
Intel Server Board S2600BP

The vulnerability allows a local user gain access to sensitive information.

The vulnerability exists due to usage of a hard-coded key in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47.A local user can gain access to sensitive information on the system.

Install updates from vendor's website.

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00434.html