High severity · published Nov 12, 2020
CVE-2020-24525
Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
N8
Nuc 8 Mainstream-g Kit Nuc8i5inh Firmware · Intel
inwhl357.0036 · source: NVD
N8
Nuc 8 Mainstream-g Kit Nuc8i7inh Firmware · Intel
inwhl357.0036 · source: NVD
N8
Nuc 8 Mainstream-g Mini PC Nuc8i5inh Firmware · Intel
inwhl357.0036 · source: NVD
N8
Nuc 8 Mainstream-g Mini PC Nuc8i7inh Firmware · Intel
inwhl357.0036 · source: NVD
N8
Nuc 8 Pro Board Nuc8i3pnb Firmware · Intel
pnwhl357.0037 · source: NVD
N8
Nuc 8 Pro Kit Nuc8i3pnh Firmware · Intel
pnwhl357.0037 · source: NVD
N8
Nuc 8 Pro Kit Nuc8i3pnk Firmware · Intel
pnwhl357.0037 · source: NVD
N8
Nuc 8 Pro Mini PC Nuc8i3pnk Firmware · Intel
pnwhl357.0037 · source: NVD
N8
Nuc 8 Rugged Kit Nuc8cchkr Firmware · Intel
chaplcel.0049 · source: NVD
N9
Nuc 9 Pro Kit Nuc9v7qnx Firmware · Intel
qncflx70.34 · source: NVD
N9
Nuc 9 Pro Kit Nuc9vxqnx Firmware · Intel
qncflx70.34 · source: NVD
NB
Nuc Board H27002-400 Firmware · Intel
tybyt10h.86a · source: NVD
Affected product
N8
Nuc 8 Mainstream-g Kit Nuc8i5inh Firmware
Intel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-24525
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-24525
Mailing List
http://seclists.org/fulldisclosure/2020/Nov/26
Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00414
More from Nuc 8 Mainstream-g Kit Nuc8i5inh Firmware
7.8
CVE-2023-28722
Improper buffer restrictions for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalation of privilege via local access
7.8
CVE-2023-29495
Improper input validation for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalation of privilege via local access
7.8
CVE-2020-12336
Insecure default variable initialization in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access
7.8
CVE-2020-0530
Improper buffer restrictions in firmware for Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via local access
6.7
CVE-2021-33164
Improper access control in BIOS firmware for some Intel(R) NUCs before version INWHL357.0046 may allow a privileged user to potentially enable escalation of privilege via local…