CVE-2020-24525
High
Description
Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access.
SeverityHigh
CVSS7.8
Exploit probability—
ProductIntel Nuc 8 Mainstream-g Kit Nuc8i5inh Firmware
PublishedNov 12, 2020
First seenNov 12, 2020
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| intel nuc_8_mainstream-g_kit_nuc8i5inh_firmware | inwhl357.0036 | — |
| intel nuc_8_mainstream-g_kit_nuc8i7inh_firmware | inwhl357.0036 | — |
| intel nuc_8_mainstream-g_mini_pc_nuc8i5inh_firmware | inwhl357.0036 | — |
| intel nuc_8_mainstream-g_mini_pc_nuc8i7inh_firmware | inwhl357.0036 | — |
| intel nuc_8_pro_board_nuc8i3pnb_firmware | pnwhl357.0037 | — |
| intel nuc_8_pro_kit_nuc8i3pnh_firmware | pnwhl357.0037 | — |
| intel nuc_8_pro_kit_nuc8i3pnk_firmware | pnwhl357.0037 | — |
| intel nuc_8_pro_mini_pc_nuc8i3pnk_firmware | pnwhl357.0037 | — |
| intel nuc_8_rugged_kit_nuc8cchkr_firmware | chaplcel.0049 | — |
| intel nuc_9_pro_kit_nuc9v7qnx_firmware | qncflx70.34 | — |
| intel nuc_9_pro_kit_nuc9vxqnx_firmware | qncflx70.34 | — |
| intel nuc_board_h27002-400_firmware | tybyt10h.86a | — |
| intel nuc_board_h27002-401_firmware | tybyt10h.86a | — |
| intel nuc_board_h27002-402_firmware | tybyt10h.86a | — |
| intel nuc_board_h27002-404_firmware | tybyt10h.86a | — |
| intel nuc_board_h27002-500_firmware | tybyt20h.86a | — |
| intel nuc_board_nuc8cchb_firmware | chaplcel.0049 | — |
| intel nuc_kit_h26998-401_firmware | tybyt10h.86a | — |
| intel nuc_kit_h26998-402_firmware | tybyt10h.86a | — |
| intel nuc_kit_h26998-403_firmware | tybyt10h.86a | — |
| intel nuc_kit_h26998-404_firmware | tybyt10h.86a | — |
| intel nuc_kit_h26998-405_firmware | tybyt10h.86a | — |
| intel nuc_kit_h26998-500_firmware | tybyt20h.86a | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.