Use of hard-coded cryptographic key in Intel products - CVE-2020-12376

Vulnerability identifier: #VU50602

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12376

CWE-ID: CWE-321

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user gain access to sensitive information.

The vulnerability exists due to usage of a hard-coded key in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47.A local user can gain access to sensitive information on the system.

Intel Server Board S2600WF
Intel Server System R1000WF
Intel Server System R2000WF
Intel Server Board S2600ST
Intel Compute Module HNS2600BP
Intel Server Board S2600BP

Install updates from vendor's website.

Intel Server Board S2600WF - update to 02.01.0013
Intel Server System R1000WF - update to 02.01.0013
Intel Server System R2000WF - update to 02.01.0013
Intel Server Board S2600ST - update to 02.01.0013
Intel Compute Module HNS2600BP - update to 02.01.0013
Intel Server Board S2600BP - update to 02.01.0013

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00434.html

• Multiple vulnerabilities in Intel Server Boards, Server Systems and Compute Modules