Improper Initialization in Intel products - CVE-2020-12357

Vulnerability identifier: #VU54161

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12357

CWE-ID: CWE-665

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper initialization in the firmware. A local administrator can run a specially crafted application to execute arbitrary code with escalated privileges on the system.

Intel Xeon Processor E5 v3 Family
11th Generation Intel Core Processors
Intel Core Processors with Intel Hybrid Technology
Intel Core X-series Processors
6th Generation Intel Core Processors
7th Generation Intel Core Processors
8th Generation Intel Core Processors
10th Generation Intel Core Processors
Intel Xeon W Processors
2nd Generation Intel Xeon Scalable Processors
Intel Xeon Processor E5 v4 Family
Intel Xeon Processor E3 v5 Family
Intel Xeon Processor E3 v6 Family
Intel Xeon Processor E7 v4 Family
Intel Xeon Processor E Family
Intel Xeon D Processors
SIMATIC IPC527GE
SINUMERIK ONE PPU 1740
SINUMERIK ONE / SINUMERIK 840D sl Handheld Terminal HT 10
SINUMERIK MC MCU 1720
SINUMERIK 828D HW PPU.4
SIMATIC S7-1500 CPU 1518F-4 PN-DP MFP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
SIMATIC Drive Controller
SIMATIC IPC477E Pro
SIMATIC IPC127E
SIMATIC Field PG M6
SIMATIC Field PG M5
SIMATIC IPC627E
SIMATIC IPC647E
SIMATIC IPC677E
SIMATIC IPC847E
Intel Xeon Scalable Processors
SIMATIC ITP1000
SIMATIC IPC547G
SIMATIC IPC477E
SIMATIC IPC427E
SIMATIC ET 200SP Open Controller CPU 1515SP PC2
Dell EMC VxRail Appliance

Install updates from vendor's website.

Dell EMC VxRail Appliance - update to 4.5.462
SIMATIC IPC627E - update to 25.02.10
SIMATIC IPC647E - update to 25.02.10
SIMATIC IPC677E - update to 25.02.10
SIMATIC IPC847E - update to 25.02.10

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html

• Multiple vulnerabilities in Intel Processors
• Multiple vulnerabilities in Siemens Industrial Products Intel CPUs
• Multiple vulnerabilities in Dell EMC VxRail Appliance