Medium severity · published Aug 14, 2024
CVE-2023-40067
Unchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege via physical access
5.7
CVSS
0.2%
EPSS
No
On KEV
Description
Unchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Attack vector
Physical
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Intel(R) CSME ·
See references · source: vendor
CS
Converged Security Management Engine Firmware · Intel
before 15.0.49; before 15.40.34; before 16.1.32 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-40067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-40067
www.intel.com
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00999.html
security.netapp.com
https://security.netapp.com/advisory/ntap-20241108-0003/
More from Intel(R) CSME
4.4
CVE-2023-34424
Improper input validation in firmware for some Intel(R) CSME may allow a privileged user to potentially enable denial of service via local access
4.3
CVE-2024-21844
Integer overflow in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable denial of service via adjacent access
2.3
CVE-2023-48361
Improper initialization in firmware for some Intel(R) CSME may allow a privileged user to potentially enable information disclosure via local access