Insufficiently protected credentials in Intel products - CVE-2022-40242

Vulnerability identifier: #VU69915

CSH Severity: High

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-40242

CWE-ID: CWE-522

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to insufficiently protected credentials, which leads to security restrictions bypass and privilege escalation.

Intel Server Board M10JNP2SB
Intel Server Board M70KLP2SB
Intel Server Board M20NTP
Cloudline CL4150 Gen10 Server
PowerProtect DD2200

Install updates from vendor's website.

Intel Server Board M10JNP2SB - update to 1.11
Intel Server Board M70KLP2SB - update to 4.15
Intel Server Board M20NTP - update to 0027
Cloudline CL4150 Gen10 Server - update to 3.09.0.0
PowerProtect DD2200 - update to 6.2.1.120

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00801.html

• Multiple vulnerabilities in Intel Server Boards BMC Firmware
• Multiple vulnerabilities in Dell PowerProtect DD2200
• Multiple vulnerabilities in HPE Cloudline CL4150 Gen10 Server