CVE-2025-24918: Medium severity Intel Server Configuration Utility vulnerability
Improper link resolution before file access ('link following') for some Intel(R) Server Configuration Utility software and Intel(R) Server Firmware Update Utility software before version 16.0.12. within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Intel(R) Server Configuration Utility software and Intel(R) Server Firmware Update Utility softwareto a version that resolves this vulnerability.Fixed in 16.0.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24918?
CVE-2025-24918 is classified as a high severity vulnerability due to its potential to allow escalation of privileges.
How do I fix CVE-2025-24918?
To fix CVE-2025-24918, upgrade the Intel Server Configuration Utility and Intel Server Firmware Update Utility to versions 16.0.12 or later.
Which Intel products are affected by CVE-2025-24918?
The affected products include Intel Server Configuration Utility and Intel Server Firmware Update Utility versions prior to 16.0.12.
What could an attacker achieve by exploiting CVE-2025-24918?
An attacker exploiting CVE-2025-24918 could gain escalated privileges on the affected system, potentially leading to unauthorized actions.
When was CVE-2025-24918 disclosed?
CVE-2025-24918 was disclosed on its official advisory date by Intel.