Medium severity · published Mar 12, 2020
CVE-2020-0526
Improper input validation in firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege via local access
6.7
CVSS
0.3%
EPSS
No
On KEV
Description
Improper input validation in firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege via local access. The list of affected products is provided in intel-sa-00343: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00343.html
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Compute Stick Stk1a32sc Firmware · Intel
sc0045 · source: NVD
CS
Compute Stick Stk1aw32sc Firmware · Intel
sc0045 · source: NVD
CS
Compute Stick Stk2m364cc Firmware · Intel
ccsklm30.86a.0062 · source: NVD
CS
Compute Stick Stk2m3w64cc Firmware · Intel
ccsklm30.86a.0062 · source: NVD
N7
Nuc 7 Enthusiast PC Nuc7i7bnhxg Firmware · Intel
bnkbl357.86a.0081 · source: NVD
N7
Nuc 7 Essential PC Nuc7cjysal Firmware · Intel
jyglkcpx.86a.0053 · source: NVD
N7
Nuc 7 Home A Mini PC Nuc7i3bnhxf Firmware · Intel
bnkbl357.86a.0081 · source: NVD
N7
Nuc 7 Home A Mini PC Nuc7i5bnhxf Firmware · Intel
bnkbl357.86a.0081 · source: NVD
N7
Nuc 7 Home A Mini PC Nuc7i5bnkp Firmware · Intel
bnkbl357.86a.0081 · source: NVD
N8
Nuc 8 Business PC Nuc8i7hnkqc Firmware · Intel
hnkbli70.86a.0059 · source: NVD
N8
Nuc 8 Enthusiast PC Nuc8i7bekqa Firmware · Intel
becfl357.86a.0077 · source: NVD
N8
Nuc 8 Home PC Nuc8i3cysm Firmware · Intel
cycnli35.86a.0044 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-0526
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-0526
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00343.html
More from Compute Stick Stk1a32sc Firmware
7.8
CVE-2021-0109
Insecure inherited permissions for the Intel(R) SOC driver package for STK1A32SC before version 604 may allow an authenticated user to potentially enable escalation of privilege…
7.8
CVE-2020-0530
Improper buffer restrictions in firmware for Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via local access