CVE-2020-12297: High severity intel converged security and manageability engine vulnerability

Q: What is the severity of CVE-2020-12297?

CVE-2020-12297 has a medium severity rating due to its potential for escalation of privileges.

Q: How do I fix CVE-2020-12297?

To fix CVE-2020-12297, update the Intel CSME driver to a version later than 14.5.25 or the Intel TXE to a version later than 4.0.30.

Q: Which Intel software is affected by CVE-2020-12297?

CVE-2020-12297 affects various versions of the Intel Converged Security and Management Engine and Intel Trusted Execution Technology.

Q: What type of vulnerability is CVE-2020-12297?

CVE-2020-12297 is an access control vulnerability that can allow an authenticated user to escalate privileges.

Q: Is local access required to exploit CVE-2020-12297?

Yes, local access is required to exploit CVE-2020-12297.

Published Nov 12, 2020

Updated

Improper access control in Installer for Intel(R) CSME Driver for Windows versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel TXE 3.1.80, 4.0.30 may allow an authenticated user to potentially enable escalation of privileges via local access.

Affected Software

8 affected components

Intel Converged Security And Manageability Engine<11.8.80

Intel Converged Security And Manageability Engine>=11.12.0<11.12.80

Intel Converged Security And Manageability Engine>=11.22.0<11.22.80

Intel Converged Security And Manageability Engine>=12.0<12.0.70

Intel Converged Security And Manageability Engine>=14.0<14.0.45

Intel Converged Security And Manageability Engine>=14.5.0<14.5.25

Intel Trusted Execution Technology=3.1.80

Intel Trusted Execution Technology=4.0.30

Event History

Nov 12, 2020

CVE Published

via MITRE·06:05 PM

Data Sourced

via MITRE·06:05 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-12297?

CVE-2020-12297 has a medium severity rating due to its potential for escalation of privileges.

How do I fix CVE-2020-12297?

To fix CVE-2020-12297, update the Intel CSME driver to a version later than 14.5.25 or the Intel TXE to a version later than 4.0.30.

Which Intel software is affected by CVE-2020-12297?

CVE-2020-12297 affects various versions of the Intel Converged Security and Management Engine and Intel Trusted Execution Technology.

What type of vulnerability is CVE-2020-12297?

CVE-2020-12297 is an access control vulnerability that can allow an authenticated user to escalate privileges.

Is local access required to exploit CVE-2020-12297?