CVE-2018-3657 Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may allow a privileged user to potentially execute arbitrary code with Intel AMT execution privilege via lo...
MediumCVSS 6.7
EPSS 0.59%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may allow a privileged user to potentially execute arbitrary code with Intel AMT execution privilege via local access.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens simatic field pg m5 firmware | < 22.01.06 | 22.01.06 |
| Siemens simatic ipc427e firmware | < 21.01.09 | 21.01.09 |
| Siemens simatic ipc477e firmware | < 21.01.09 | 21.01.09 |
| Siemens simatic ipc547e firmware | < r1.30.0 | r1.30.0 |
| Siemens simatic pc547g firmware | < r1.23.0 | r1.23.0 |
| Siemens simatic ipc627d firmware | < 19.02.11 | 19.02.11 |
| Siemens simatic ipc647d firmware | < 19.01.14 | 19.01.14 |
| Siemens simatic ipc677d firmware | < 19.02.11 | 19.02.11 |
| Siemens simatic ipc827d firmware | < 19.02.11 | 19.02.11 |
| Siemens simatic ipc847d firmware | < 19.01.14 | 19.01.14 |
| Siemens simatic itp1000 firmware | < 23.01.04 | 23.01.04 |
| intel converged security management engine firmware | >= 11.0.0, < 12.0.5 | 12.0.5 |
| intel active management technology firmware | < 12.0.5 | 12.0.5 |
| intel manageability engine firmware | >= 9.0.0.0, < 11.0 | 11.0 |
| Intel(R) Active Management Technology | = Versions before version 12.0.5. | No fix listed |
References
- 106996 third-party-advisory vdb-entry
- cert-portal.siemens.com patch third-party-advisory
- ics-cert.us-cert.gov third-party-advisory us-government-resource
- security.netapp.com third-party-advisory
- support.hpe.com third-party-advisory
- www.intel.com vendor-advisory