CVE-2018-12147: Intel Converged Security Management Engine Firmware

Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days.

Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access.

Affected products

• Intel Converged Security Management Engine Firmware: from 11.0, up to and including 11.8.50; from 11.10, up to and including 11.11.50; from 11.20, up to and including 11.21.51
• Intel Server Platform Services Firmware: before 4.0 (fixed in 4.0)
• Intel Trusted Execution Engine Firmware: from 3.0, up to and including 3.1.50

Published 2019-06-13. Last modified 2026-06-17.