Vulnerability identifier: #VU50693

Vulnerability risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24450

CWE-ID: CWE-426

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Intel Server Board S1200SP
Hardware solutions / Firmware
Intel Server Board S2600
Hardware solutions / Firmware
Intel Server System MCB2208
Hardware solutions / Firmware
Intel Server System R1208
Hardware solutions / Firmware
Intel Server System R1304
Hardware solutions / Firmware
Intel Server System R2208
Hardware solutions / Firmware
Intel Server System R2224
Hardware solutions / Firmware
Intel Server System R2308
Hardware solutions / Firmware
Intel Server System R2312
Hardware solutions / Firmware
Intel Server System VRN2208
Hardware solutions / Firmware
Server Board Onboard Video Driver for Windows
Hardware solutions / Drivers

Vendor: Intel

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an untrusted search path in the installer. A local user can gain elevated prvileges on the target system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Intel Server Board S1200SP: All versions

Intel Server Board S2600: All versions

Intel Server System MCB2208: All versions

Intel Server System R1208: All versions

Intel Server System R1304: All versions

Intel Server System R2208: All versions

Intel Server System R2224: All versions

Intel Server System R2308: All versions

Intel Server System R2312: All versions

Intel Server System VRN2208: All versions

---

External links
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00443.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.