CVE-2018-12192
First published: Tue Mar 12 2019(Updated: )
Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_04.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access.
Credit: secure@intel.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Intel Converged Security Management Engine Firmware | >=11.0<11.8.60 | |
| Intel Converged Security Management Engine Firmware | >=11.10<11.11.60 | |
| Intel Converged Security Management Engine Firmware | >=11.20<11.22.60 | |
| Intel Converged Security Management Engine Firmware | >=12.0.0<12.0.20 | |
| Intel Server Platform Services Firmware | <sps_e5_04.00.04.393.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this logic bug?
The vulnerability ID for this logic bug is CVE-2018-12192.
What is the severity level of CVE-2018-12192?
The severity level of CVE-2018-12192 is high, with a severity value of 6.8.
Which software versions are affected by CVE-2018-12192?
CVE-2018-12192 affects Intel Converged Security Management Engine Firmware versions 11.0 to 11.8.60, 11.10 to 11.11.60, 11.20 to 11.22.60, and 12.0.0 to 12.0.20, as well as Intel Server Platform Services Firmware version SPS_E5_04.00.04.393.0.
How can an unauthenticated user potentially exploit CVE-2018-12192?
An unauthenticated user may potentially bypass MEBx authentication via physical access.
Where can I find more information about CVE-2018-12192?
More information about CVE-2018-12192 can be found in the following references: [NetApp Advisory](https://security.netapp.com/advisory/ntap-20190318-0001/), [HPE Security Bulletin](https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03914en_us), [Intel Advisory](https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html).
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/event
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/intel
- canonical/intel converged security management engine firmware
- version/intel converged security management engine firmware/11.0
- version/intel converged security management engine firmware/11.10
- version/intel converged security management engine firmware/11.20
- version/intel converged security management engine firmware/12.0.0
- canonical/intel server platform services firmware