CVE-2017-5689 An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged....
CriticalCVSS 9.8
EPSS 92.2%
CISA KEV
added 2022-01-28 · due 2022-07-28
Exploited in the wild
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
CISA Known Exploited Vulnerability
- Date added
- 2022-01-28
- Due date (FCEB)
- 2022-07-28
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hpe proliant ml10 gen9 server firmware | = 5.0 | No fix listed |
| Siemens simatic itp1000 firmware | < 9.1.41.3024 | 9.1.41.3024 |
| Siemens simatic ipc847d firmware | < 9.1.41.3024 | 9.1.41.3024 |
| Siemens simatic ipc847c firmware | < 6.2.61.3535 | 6.2.61.3535 |
| Siemens simatic ipc827d firmware | < 9.1.41.3024 | 9.1.41.3024 |
| Siemens simatic ipc827c firmware | < 6.2.61.3535 | 6.2.61.3535 |
| Siemens simatic ipc677d firmware | < 9.1.41.3024 | 9.1.41.3024 |
| Siemens simatic ipc677c firmware | < 6.2.61.3535 | 6.2.61.3535 |
| Siemens simatic ipc647d firmware | < 9.1.41.3024 | 9.1.41.3024 |
| Siemens simatic ipc647c firmware | < 6.2.61.3535 | 6.2.61.3535 |
| Siemens simatic ipc627d firmware | < 9.1.41.3024 | 9.1.41.3024 |
| Siemens simatic ipc627c firmware | < 6.2.61.3535 | 6.2.61.3535 |
| Siemens simatic ipc547g firmware | < 11.0.26.3000 | 11.0.26.3000 |
| Siemens simatic ipc547e firmware | < 9.1.41.3024 | 9.1.41.3024 |
| Siemens simatic ipc547d firmware | < 7.1.91.3272 | 7.1.91.3272 |
| Siemens simatic ipc477e firmware | < 21.01.05 | 21.01.05 |
| Siemens simatic ipc477d firmware | All versions | No fix listed |
| Siemens simatic field pg m3 firmware | < 6.2.61.3535 | 6.2.61.3535 |
| Siemens simatic field pg m4 firmware | < 18.01.06 | 18.01.06 |
| Siemens simatic field pg m5 firmware | < 22.01.03 | 22.01.03 |
| Siemens simatic pcs 7 ipc427e firmware | < 21.01.04 | 21.01.04 |
| Siemens simatic pcs 7 ipc427e firmware | All versions | No fix listed |
| Siemens simatic pcs 7 ipc547d firmware | < 7.1.91.3272 | 7.1.91.3272 |
| Siemens simatic pcs 7 ipc547e firmware | < 9.1.41.3024 | 9.1.41.3024 |
| Siemens simatic pcs 7 ipc547g firmware | < 11.0.26.3000 | 11.0.26.3000 |
Show 26 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens simatic pcs 7 ipc627c firmware | < 6.2.61.3535 | 6.2.61.3535 |
| Siemens simatic pcs 7 ipc677c firmware | < 6.2.61.3535 | 6.2.61.3535 |
| Siemens simatic pcs 7 ipc647c firmware | < 6.2.61.3535 | 6.2.61.3535 |
| Siemens simatic pcs 7 ipc647d firmware | < 9.1.41.3024 | 9.1.41.3024 |
| Siemens simatic pcs 7 ipc847c firmware | < 6.2.61.3535 | 6.2.61.3535 |
| Siemens simatic pcs 7 ipc847d firmware | < 9.1.41.3024 | 9.1.41.3024 |
| Siemens simatic pcs 7 ipc477d firmware | All versions | No fix listed |
| Siemens simatic ipc427d firmware | All versions | No fix listed |
| Siemens simatic ipc427e firmware | < 21.01.05 | 21.01.05 |
| Siemens simotion p320-4 s firmware | < 17.02.06.83.1 | 17.02.06.83.1 |
| Siemens sinumerik pcu50.5-p firmware | < 6.2.61.3535 | 6.2.61.3535 |
| intel active management technology firmware | = 6.0 | No fix listed |
| intel active management technology firmware | = 6.1 | No fix listed |
| intel active management technology firmware | = 6.2 | No fix listed |
| intel active management technology firmware | = 7.0 | No fix listed |
| intel active management technology firmware | = 7.1 | No fix listed |
| intel active management technology firmware | = 8.0 | No fix listed |
| intel active management technology firmware | = 8.1 | No fix listed |
| intel active management technology firmware | = 9.0 | No fix listed |
| intel active management technology firmware | = 9.1 | No fix listed |
| intel active management technology firmware | = 9.5 | No fix listed |
| intel active management technology firmware | = 10.0 | No fix listed |
| intel active management technology firmware | = 11.0 | No fix listed |
| intel active management technology firmware | = 11.5 | No fix listed |
| intel active management technology firmware | = 11.6 | No fix listed |
| Intel Active Mangement Technology, Intel Small Business Technology, Intel Standard Manageability | = fixed in versions 6.2.61.3535, 7.1.91.3272, 8.1.71.3608, 9.1.41.3024, 10.0.55.3000, 11.0.25.3001, and 11.6.27.3264 and later | No fix listed |
References
- www.oracle.com patch third-party-advisory
- 98269 broken-link third-party-advisory vdb-entry
- 1038385 broken-link third-party-advisory vdb-entry
- cert-portal.siemens.com third-party-advisory
- downloadmirror.intel.com broken-link
- h20566.www2.hpe.com third-party-advisory
- security-center.intel.com patch vendor-advisory
- security.netapp.com third-party-advisory
- www.embedi.com broken-link exploit technical-description third-party-advisory
- www.embedi.com broken-link third-party-advisory
- www.tenable.com technical-description third-party-advisory
- www.cisa.gov government-resource us-government-resource