Vulnerability Name:

CVE-2020-8745 (CCN-191451)

Assigned:2020-11-10
Published:2020-11-10
Updated:2022-10-14
Summary:Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS v3 Severity:6.8 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
5.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Physical
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Physical
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2020-8745

Source: CONFIRM
Type: Patch, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf

Source: XF
Type: UNKNOWN
intel-cve20208745-priv-esc(191451)

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20201113-0002/

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20201113-0005/

Source: CCN
Type: Lenovo Security Advisory: LEN-39432
Intel CSME, SPS, TXE, DAL and AMT Advisory

Source: MISC
Type: Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391

Source: CCN
Type: INTEL-SA-00391
2020.2 IPU Intel CSME, SPS, TXE, AMT and DAL Advisory

Vulnerable Configuration:Configuration 1:
  • cpe:/a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:* (Version < 11.8.80)
  • OR cpe:/a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:* (Version >= 11.12.0 and < 11.12.80)
  • OR cpe:/a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:* (Version >= 11.22.0 and < 11.22.80)
  • OR cpe:/a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:* (Version >= 12.0 and < 12.0.70)
  • OR cpe:/a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:* (Version >= 14.0 and < 14.0.45)
  • OR cpe:/a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:* (Version >= 14.5.0 and < 14.5.25)

    • Configuration 2:
  • cpe:/a:intel:trusted_execution_technology:*:*:*:*:*:*:*:* (Version < 3.1.80)
  • OR cpe:/a:intel:trusted_execution_technology:*:*:*:*:*:*:*:* (Version >= 4.0 and < 4.0.30)

    • Configuration 3:
  • cpe:/o:siemens:simatic_drive_controller_firmware:*:*:*:*:*:*:*:* (Version < 05.00.01.00)
  • AND
  • cpe:/h:siemens:simatic_drive_controller:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:siemens:simatic_et200sp_1515sp_pc2_firmware:*:*:*:*:*:*:*:* (Version < 0209.0105)
  • AND
  • cpe:/h:siemens:simatic_et200sp_1515sp_pc2:-:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:* (Version < 22.01.08)
  • AND
  • cpe:/h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/o:siemens:simatic_field_pg_m6_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_field_pg_m6:-:*:*:*:*:*:*:*

    • Configuration 7:
  • cpe:/o:siemens:simatic_ipc127e_firmware:*:*:*:*:*:*:*:* (Version < 27.01.05)
  • AND
  • cpe:/h:siemens:simatic_ipc127e:-:*:*:*:*:*:*:*

    • Configuration 8:
  • cpe:/o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:* (Version < 27.01.05)
  • AND
  • cpe:/h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:* (Version < 27.01.05)
  • AND
  • cpe:/h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:*
  • OR cpe:/h:siemens:simatic_ipc477e_pro:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:siemens:simatic_ipc527g_firmware:*:*:*:*:*:*:*:* (Version < 1.4.0)
  • AND
  • cpe:/h:siemens:simatic_ipc527g:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:siemens:simatic_ipc547g_firmware:*:*:*:*:*:*:*:* (Version < r1.30.0)
  • AND
  • cpe:/h:siemens:simatic_ipc547g:-:*:*:*:*:*:*:*

    • Configuration 12:
  • cpe:/o:siemens:simatic_ipc627e_firmware:*:*:*:*:*:*:*:* (Version < 25.02.08)
  • AND
  • cpe:/h:siemens:simatic_ipc627e:-:*:*:*:*:*:*:*

    • Configuration 13:
  • cpe:/o:siemens:simatic_ipc647e_firmware:*:*:*:*:*:*:*:* (Version < 25.02.08)
  • AND
  • cpe:/h:siemens:simatic_ipc647e:-:*:*:*:*:*:*:*

    • Configuration 14:
  • cpe:/o:siemens:simatic_ipc667e_firmware:*:*:*:*:*:*:*:* (Version < 25.02.08)
  • AND
  • cpe:/h:siemens:simatic_ipc667e:-:*:*:*:*:*:*:*

    • Configuration 15:
  • cpe:/o:siemens:simatic_ipc847e_firmware:*:*:*:*:*:*:*:* (Version < 25.02.08)
  • AND
  • cpe:/h:siemens:simatic_ipc847e:-:*:*:*:*:*:*:*

    • Configuration 16:
  • cpe:/o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:* (Version < 23.01.08)
  • AND
  • cpe:/h:siemens:simatic_itp1000:-:*:*:*:*:*:*:*

    • Configuration 17:
  • cpe:/o:siemens:sinumerik_828d_hw_pu.4_firmware:*:*:*:*:*:*:*:* (Version < 08.00.00.00)
  • AND
  • cpe:/h:siemens:sinumerik_828d_hw_pu.4:-:*:*:*:*:*:*:*

    • Configuration 18:
  • cpe:/o:siemens:sinumerik_mc_mcu_1720_firmware:*:*:*:*:*:*:*:* (Version < 05.00.00.00)
  • AND
  • cpe:/h:siemens:sinumerik_mc_mcu_1720:-:*:*:*:*:*:*:*

    • Configuration 19:
  • cpe:/o:siemens:sinumerik_one_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:sinumerik_one:-:*:*:*:*:*:*:*

    • Configuration 20:
  • cpe:/o:siemens:sinumerik_840d_sl_ht_10_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:sinumerik_840d_sl_ht_10:-:*:*:*:*:*:*:*

    • Configuration 21:
  • cpe:/o:siemens:sinumerik_one_ncu_1740_firmware:*:*:*:*:*:*:*:* (Version < 04.00.00.00)
  • AND
  • cpe:/h:siemens:sinumerik_one_ncu_1740:-:*:*:*:*:*:*:*

    • Configuration 22:
  • cpe:/o:siemens:sinumerik_one_ppu_1740_firmware:*:*:*:*:*:*:*:* (Version < 06.00.00.00)
  • AND
  • cpe:/h:siemens:sinumerik_one_ppu_1740:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    intel converged security and manageability engine *
    intel converged security and manageability engine *
    intel converged security and manageability engine *
    intel converged security and manageability engine *
    intel converged security and manageability engine *
    intel converged security and manageability engine *
    intel trusted execution technology *
    intel trusted execution technology *
    siemens simatic drive controller firmware *
    siemens simatic drive controller -
    siemens simatic et200sp 1515sp pc2 firmware *
    siemens simatic et200sp 1515sp pc2 -
    siemens simatic field pg m5 firmware *
    siemens simatic field pg m5 -
    siemens simatic field pg m6 firmware -
    siemens simatic field pg m6 -
    siemens simatic ipc127e firmware *
    siemens simatic ipc127e -
    siemens simatic ipc427e firmware *
    siemens simatic ipc427e -
    siemens simatic ipc477e firmware *
    siemens simatic ipc477e -
    siemens simatic ipc477e pro -
    siemens simatic ipc527g firmware *
    siemens simatic ipc527g -
    siemens simatic ipc547g firmware *
    siemens simatic ipc547g -
    siemens simatic ipc627e firmware *
    siemens simatic ipc627e -
    siemens simatic ipc647e firmware *
    siemens simatic ipc647e -
    siemens simatic ipc667e firmware *
    siemens simatic ipc667e -
    siemens simatic ipc847e firmware *
    siemens simatic ipc847e -
    siemens simatic itp1000 firmware *
    siemens simatic itp1000 -
    siemens sinumerik 828d hw pu.4 firmware *
    siemens sinumerik 828d hw pu.4 -
    siemens sinumerik mc mcu 1720 firmware *
    siemens sinumerik mc mcu 1720 -
    siemens sinumerik one firmware -
    siemens sinumerik one -
    siemens sinumerik 840d sl ht 10 firmware -
    siemens sinumerik 840d sl ht 10 -
    siemens sinumerik one ncu 1740 firmware *
    siemens sinumerik one ncu 1740 -
    siemens sinumerik one ppu 1740 firmware *
    siemens sinumerik one ppu 1740 -