CVE-2020-24507: Intel Converged Security And Manageability Engine

Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Improper initialization in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11 and 15.0.22 may allow a privileged user to potentially enable information disclosure via local access.

Affected products

• Intel Converged Security And Manageability Engine: before 12.0.81 (fixed in 12.0.81); before 13.0.47 (fixed in 13.0.47); before 13.30.17 (fixed in 13.30.17); before 14.1.53 (fixed in 14.1.53); before 14.5.32 (fixed in 14.5.32); before 11.8.86 (fixed in 11.8.86); …
• Siemens SIMATIC Field Pg m5 Firmware: any version
• Siemens SIMATIC Field Pg m6 Firmware: any version
• Siemens SIMATIC IPC427E Firmware: any version
• Siemens SIMATIC IPC477E Firmware: any version
• Siemens SIMATIC IPC477E Pro Firmware: any version
• Siemens SIMATIC IPC527G Firmware: any version
• Siemens SIMATIC IPC547G Firmware: any version
• Siemens SIMATIC IPC627E Firmware: before 25.02.10 (fixed in 25.02.10)
• Siemens SIMATIC IPC647E Firmware: before 25.02.10 (fixed in 25.02.10)
• Siemens SIMATIC IPC677E Firmware: before 25.02.10 (fixed in 25.02.10)
• Siemens SIMATIC IPC847E Firmware: before 25.02.10 (fixed in 25.02.10)
• Siemens SIMATIC ITP1000 Firmware: any version

Published 2021-06-09. Last modified 2026-06-17.