Intel Raid Web Console 3 vulnerabilities

6 CVEs affecting Intel Raid Web Console 3, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-8688, published 2020-08-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-11119, published 2019-06-13. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. Insufficient session validation in the service API for Intel(R) RWC3 version 4.186 and before may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVE-2020-8688, published 2020-08-13. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. Improper input validation in the Intel(R) RAID Web Console 3 for Windows* may allow an unauthenticated user to potentially enable denial of service via network access.
CVE-2018-3699, published 2018-11-14. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Cross-site scripting in the Intel RAID Web Console v3 for Windows may allow an unauthenticated user to elevate privilege via remote access.
CVE-2018-3696, published 2018-11-14. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Authentication bypass in the Intel RAID Web Console 3 for Windows before 4.186 may allow an unprivileged user to potentially gain administrative privileges via local access.
CVE-2020-0564, published 2020-02-13. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper permissions in the installer for Intel(R) RWC3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2019-14601, published 2020-01-17. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper permissions in the installer for Intel(R) RWC 3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalation of privilege via local access.