Buffer overflow in Intel Active Management Technology Firmware
CVE-2018-3628
Buffer overflow in HTTP handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5.x, 6.x, 7.x, 8.x, 9.x, 10.x, and 11.x may allow an attacker to execute arbitrary code via the same subnet.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.014 (72.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 72.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
- Intel Active Management Technology Firmware
- Intel Core 2 Duo — versions e4300, e4400, e4500
- Intel Core 2 Extreme — versions qx6700, qx6800, qx6850
- Intel Core 2 Quad — versions q6600, q6700, q8200
- Intel Core 2 Solo — versions su3500, u2100, u2200
- Intel Core Duo — versions l2300, l2400, l2500
- Intel Core I3 — versions 4000m, 4005u, 4010u
- Intel Core I5 — versions 4200h, 4200m, 4200u
- Intel Core I7 — versions 4500u, 4510u, 4550u
- Intel Core I9 — versions 8950hk
Weakness classification (CWE)
References
- www.securitytracker.com/id/1041362 (VDB Entry, Third Party Advisory, vdb-entry)
- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html (Vendor Advisory)
- support.hpe.com/hpsc/doc/public/display (Third Party Advisory)
- security.netapp.com/advisory/ntap-20190327-0001/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2018-3628?
- CVE-2018-3628 is a high-severity vulnerability in Intel Active Management Technology Firmware, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.8/10. Published 2018-07-10.
- How severe is CVE-2018-3628?
- High severity. CVSS v3 base score is 8.8 out of 10.