Medium severity · published Nov 11, 2022
CVE-2022-21794
Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits before version HN0067 may allow a…
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits before version HN0067 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits ·
before version HN0067 · source: vendor
N8
Nuc 8 Business Nuc8i7hnkqc Firmware · Intel
before hn0067 · source: NVD
N8
Nuc 8 Enthusiast Nuc8i7hvkva Firmware · Intel
before hn0067 · source: NVD
N8
Nuc 8 Enthusiast Nuc8i7hvkvaw Firmware · Intel
before hn0067 · source: NVD
NK
Nuc Kit Nuc8i7hnk Firmware · Intel
before hn0067 · source: NVD
NK
Nuc Kit Nuc8i7hvk Firmware · Intel
before hn0067 · source: NVD
Affected product
IN
Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits