CVE-2020-24493 : Insufficient access control in the firmware for the Intel(R) 700-series of Ether

Insufficient access control in the firmware for the Intel(R) 700-series of Ethernet Controllers before version 8.0 may allow a privileged user to potentially enable denial of service via local access.

Published 2021-02-17 14:15:18

Updated 2021-07-21 11:39:24

Source Intel Corporation

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2020-24493

Intel » Ethernet Network Adapter 700 Firmware
Versions before (<) 8.0
cpe:2.3:o:intel:ethernet_network_adapter_700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Ethernet Network Adapter V710-at2 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-am2 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-at2 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-bm2 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-da2 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-da2 For Ocp » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-da2 For Ocp 3.0 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-da4 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-da4 For Ocp 3.0 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-t2l » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-t2l For Ocp 3.0 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-t4 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-t4l » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-t4l For Ocp 3.0 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X710-tm4 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X722-da2 » Version: N/A
When used together with: Intel » Ethernet Network Adapter X722-da4 » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xl710-am1 » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xl710-am2 » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xl710-bm1 » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xl710-bm2 » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xl710-qda1 » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xl710-qda1 For Open Compute Project » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xl710-qda2 For Open Compute Project » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xlk710-qda2 » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xxv710-am1 » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xxv710-am2 » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xxv710-da1 » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xxv710-da1 For Ocp » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xxv710-da2 » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xxv710-da2t » Version: N/A
When used together with: Intel » Ethernet Network Adapter Xxv710-dax For Ocp » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-24493

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 14 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-24493

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:N/A:P	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
4.4	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	0.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2020-24493

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html

INTEL-SA-00456
Patch;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-24493

Products affected by CVE-2020-24493

Exploit prediction scoring system (EPSS) score for CVE-2020-24493

CVSS scores for CVE-2020-24493

References for CVE-2020-24493