Intel Trusted Execution Engine Firmware vulnerabilities

27 CVEs affecting Intel Trusted Execution Engine Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-0566, published 2020-06-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-11090, published 2019-12-18. Medium severity, CVSS 5.9. EPSS: 2.7% chance of exploitation in the next 30 days. Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70 and 4.0.20; Intel(R) SPS before…
CVE-2020-0536, published 2020-06-15. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and Intel(R) TXE versions before 3.1.75 and 4.0.25 may allow an…
CVE-2019-0169, published 2019-12-18. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an unauthenticated user to potentially…
CVE-2017-5707, published 2017-11-21. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Multiple buffer overflows in kernel in Intel Trusted Execution Engine Firmware 3.0 allow attacker with local access to the system to execute arbitrary code.
CVE-2017-5710, published 2017-11-21. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Multiple privilege escalations in kernel in Intel Trusted Execution Engine Firmware 3.0 allows unauthorized process to access privileged content via unspecified vector.
CVE-2018-12208, published 2019-03-14. High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days. Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel(R) TXE version before 3.1.60 or 4.0.10, or Intel(R) Server Platform Services before…
CVE-2018-12199, published 2019-03-14. Medium severity, CVSS 6.2. EPSS: 0.5% chance of exploitation in the next 30 days. Buffer overflow in an OS component in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel TXE version before 3.1.60 or 4.0.10 may allow a privileged user to potentially…
CVE-2018-12191, published 2019-03-14. High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days. Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before versions 4.00.04.383 or SPS 4.01.02.174, or Intel(R)…
CVE-2020-0566, published 2020-06-15. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Access Control in subsystem for Intel(R) TXE versions before 3.175 and 4.0.25 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVE-2019-0098, published 2019-05-17. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticated user to potentially enable escalation of privilege via…

Latest

CVE-2020-0539, published 2020-06-15. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Path traversal in subsystem for Intel(R) DAL software for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33 and Intel(R) TXE versions before 3.1.75, 4.0.25 may…
CVE-2019-11147, published 2019-12-18. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Insufficient access control in hardware abstraction driver for MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0, 14.0.10; TXEInfo software for Intel(R)…
CVE-2019-11110, published 2019-12-18. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. Authentication bypass in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a…
CVE-2019-11106, published 2019-12-18. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to…
CVE-2019-11104, published 2019-12-18. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Insufficient input validation in MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow…
CVE-2019-11102, published 2019-12-18. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient input validation in Intel(R) DAL software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may…
CVE-2019-11101, published 2019-12-18. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a…
CVE-2019-11097, published 2019-12-18. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper directory permissions in the installer for Intel(R) Management Engine Consumer Driver for Windows before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45,13.0.10 and 14.0.10; Intel(R) TXE…