Vulnerabilities > CVE-2020-0533 - Use of Password Hash With Insufficient Computational Effort vulnerability in Intel Converged Security Management Engine Firmware

CVSS 4.6 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

local

low complexity

intel

CWE-916

NVD

Published: 2020-06-15

Updated: 2021-07-21

Summary

Reversible one-way hash in Intel(R) CSME versions before 11.8.76, 11.12.77 and 11.22.77 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access.

Vulnerable Configurations

Part	Description	Count
OS	Intel Intel Converged Security Management Engine Firmware 11.0 Intel Converged Security Management Engine Firmware 11.8.50 Intel Converged Security Management Engine Firmware 11.8.55 Intel Converged Security Management Engine Firmware 11.8.60 Intel Converged Security Management Engine Firmware 11.8.65 Intel Converged Security Management Engine Firmware 11.8.70 Intel Converged Security Management Engine Firmware 11.10 Intel Converged Security Management Engine Firmware 11.11.50 Intel Converged Security Management Engine Firmware 11.11.55 Intel Converged Security Management Engine Firmware 11.11.60 Intel Converged Security Management Engine Firmware 11.11.65 Intel Converged Security Management Engine Firmware 11.11.70 Intel Converged Security Management Engine Firmware 11.11.77 Intel Converged Security Management Engine Firmware 11.11.79 Intel Converged Security Management Engine Firmware 11.20 Intel Converged Security Management Engine Firmware 11.21.51 Intel Converged Security Management Engine Firmware 11.22.0 Intel Converged Security Management Engine Firmware 11.22.60 Intel Converged Security Management Engine Firmware 11.22.65 Intel Converged Security Management Engine Firmware 11.22.70	20

Common Weakness Enumeration (CWE)

CWE-916 - Use of Password Hash With Insufficient Computational Effort

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References