CVE-2020-12297
First published: Thu Nov 12 2020(Updated: )
Improper access control in Installer for Intel(R) CSME Driver for Windows versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel TXE 3.1.80, 4.0.30 may allow an authenticated user to potentially enable escalation of privileges via local access.
Credit: secure@intel.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Intel Converged Security and Manageability Engine | <11.8.80 | |
| Intel Converged Security and Manageability Engine | >=11.12.0<11.12.80 | |
| Intel Converged Security and Manageability Engine | >=11.22.0<11.22.80 | |
| Intel Converged Security and Manageability Engine | >=12.0<12.0.70 | |
| Intel Converged Security and Manageability Engine | >=14.0<14.0.45 | |
| Intel Converged Security and Manageability Engine | >=14.5.0<14.5.25 | |
| Intel Trusted Execution Technology | =3.1.80 | |
| Intel Trusted Execution Technology | =4.0.30 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-12297?
CVE-2020-12297 has a medium severity rating due to its potential for escalation of privileges.
How do I fix CVE-2020-12297?
To fix CVE-2020-12297, update the Intel CSME driver to a version later than 14.5.25 or the Intel TXE to a version later than 4.0.30.
Which Intel software is affected by CVE-2020-12297?
CVE-2020-12297 affects various versions of the Intel Converged Security and Management Engine and Intel Trusted Execution Technology.
What type of vulnerability is CVE-2020-12297?
CVE-2020-12297 is an access control vulnerability that can allow an authenticated user to escalate privileges.
Is local access required to exploit CVE-2020-12297?
Yes, local access is required to exploit CVE-2020-12297.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/author
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/intel
- canonical/intel converged security and manageability engine
- version/intel converged security and manageability engine/11.12.0
- version/intel converged security and manageability engine/11.22.0
- version/intel converged security and manageability engine/12.0
- version/intel converged security and manageability engine/14.0
- version/intel converged security and manageability engine/14.5.0
- canonical/intel trusted execution technology
- version/intel trusted execution technology/3.1.80
- version/intel trusted execution technology/4.0.30