CVE-2018-12147

Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access.

Published: Jun 13, 2019
Updated: Apr 13, 2023
CVE: CVE-2018-12147
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.7
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.2
AV:L/AC:L/Au:N/C:C/I:C/A:C

CWEs:

CWE-20

Affected Software
References

Software	From	Fixed in
intel / converged_security_management_engine_firmware	11.20	11.21.51.x
intel / converged_security_management_engine_firmware	11.10	11.11.50.x
intel / converged_security_management_engine_firmware	11.0	11.8.50.x
intel / server_platform_services_firmware	-	4.0
intel / trusted_execution_engine_firmware	3.0	3.1.50.x

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html?wapkw=2018-12147

Vulnerability Database

CVE-2018-12147

Deep Security Visibility Without the Complexity