CVE-2017-5689criticalunder attackCWE-269

CVE-2017-5689: critical vulnerability in Intel Active Mangement Technology, Intel Small…

Published · Updated

Follow this CVE+ Monitor Active Management Technology, Small Business Technology, and Standard Manageability+ Monitor Intel Active Mangement Technology, Intel Small Business Technology, Intel Standard Manageability

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 92%
from disclosure to weapon2 days
Published on NVDMay 2
1st PoC+2d
metasploit+3d
CISA KEV+1732d
Action required by CISAfederal deadline: 2022-07-28

Apply updates per vendor instructions.

In short

A vulnerability in Intel's management systems (AMT, ISM, SBT) allows attackers from the network or from the local computer to gain full system control without needing special privileges. This is critical because it bypasses all security protections on affected Intel systems.

Technical detail

CWE-269 (Improper Access Control) in Intel Active Management Technology, Standard Manageability, and Small Business Technology enables unprivileged network attackers to escalate to system privileges, and unprivileged local attackers to provision manageability features for privilege escalation. The vulnerability affects pre-provisioned Intel manageability SKUs and requires no authentication or special conditions to exploit.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Intel Corporation · Intel Active Mangement Technology, Intel Small Business Technology, Intel Standard Manageability
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.