Improper Authentication in Converged Security and Management Engine (CSME) and Intel Active Management Technology - CVE-2021-33159

Vulnerability identifier: #VU69314

CSH Severity: Low

CVSS v4: 5.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33159

CWE-ID: CWE-287

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests in firmware. A local administrator can bypass authentication process and gain elevated privileges on the system.

Converged Security and Management Engine (CSME)
Intel Active Management Technology
HPE ProLiant DL20 Gen9 Server SPS
HPE ProLiant ML30 Gen9 Server SPS
HPE ProLiant MicroServer Gen10 Plus
HPE ProLiant DL20 Gen10 Plus server
HPE ProLiant ML30 Gen10 Plus server
EGW-5200
Avamar Data Store Gen5A

Install updates from vendor's website.

Converged Security and Management Engine (CSME) - addressed in versions 11.8.93, 11.12.93, 11.22.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25
Intel Active Management Technology - addressed in versions 11.8.93, 11.22.93, 12.0.92, 14.1.67, 15.0.42, 16.0
HPE ProLiant DL20 Gen9 Server SPS - update to SPS_E3_04.01.04.700.0
HPE ProLiant ML30 Gen9 Server SPS - update to SPS_E3_04.01.04.700.0
HPE ProLiant MicroServer Gen10 Plus - update to SPS_E3_06.00.03.204.0
HPE ProLiant DL20 Gen10 Plus server - update to SPS_E3_06.00.03.204.0
HPE ProLiant ML30 Gen10 Plus server - update to SPS_E3_06.00.03.204.0
EGW-5200 - update to 1.06.10 2V4

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00610.html

• Multiple vulnerabilities in Intel Chipset Firmware
• Multiple vulnerabilities in Dell EGW-5200
• Multiple vulnerabilities in Certain HPE ProLiant DL/ML Servers
• Multiple vulnerabilities in Dell Avamar Data Store Gen5A