Intel Server Platform Services Firmware vulnerabilities

15 CVEs affecting Intel Server Platform Services Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-29515, published 2022-11-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-11090, published 2019-12-18. Medium severity, CVSS 5.9. EPSS: 2.7% chance of exploitation in the next 30 days. Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70 and 4.0.20; Intel(R) SPS before…
CVE-2017-5706, published 2017-11-21. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple buffer overflows in kernel in Intel Server Platform Services Firmware 4.0 allow attacker with local access to the system to execute arbitrary code.
CVE-2017-5709, published 2017-11-21. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Multiple privilege escalations in kernel in Intel Server Platform Services Firmware 4.0 allows unauthorized process to access privileged content via unspecified vector.
CVE-2018-12208, published 2019-03-14. High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days. Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel(R) TXE version before 3.1.60 or 4.0.10, or Intel(R) Server Platform Services before…
CVE-2018-12191, published 2019-03-14. High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days. Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before versions 4.00.04.383 or SPS 4.01.02.174, or Intel(R)…
CVE-2018-3643, published 2018-09-12. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55, 11.21.55, 12.0.6 or…
CVE-2018-12192, published 2019-03-14. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_04.00.04.393.0 may allow an…
CVE-2018-3655, published 2018-09-12. High severity, CVSS 7.3. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Execution Engine Firmware before version 3.1.55 may allow an…
CVE-2018-12147, published 2019-06-13. Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days. Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before…
CVE-2019-0099, published 2019-05-17. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. Insufficient access control vulnerability in subsystem in Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via…

Latest

CVE-2022-29515, published 2022-11-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Missing release of memory after effective lifetime in firmware for Intel(R) SPS before versions SPS_E3_06.00.03.035.0 may allow a privileged user to potentially enable denial of service via local…
CVE-2022-29466, published 2022-11-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper input validation in firmware for Intel(R) SPS before version SPS_E3_04.01.04.700.0 may allow an authenticated user to potentially enable denial of service via local access.
CVE-2022-26074, published 2022-08-18. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. Incomplete cleanup in a firmware subsystem for Intel(R) SPS before versions SPS_E3_04.08.04.330.0 and SPS_E3_04.01.04.530.0 may allow a privileged user to potentially enable denial of service via…
CVE-2019-11109, published 2019-12-18. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. Logic issue in the subsystem for Intel(R) SPS before versions SPS_E5_04.01.04.275.0, SPS_SoC-X_04.00.04.100.0 and SPS_SoC-A_04.00.04.191.0 may allow a privileged user to potentially enable denial of…
CVE-2018-12198, published 2019-03-14. Medium severity, CVSS 6.0. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient input validation in Intel(R) Server Platform Services HECI subsystem before version SPS_E5_04.00.04.393.0 may allow privileged user to potentially cause a denial of service via local…