CVE-2022-32577 : Improper input validation in BIOS Firmware for some Intel(R) NUC Kits before ver

Improper input validation in BIOS Firmware for some Intel(R) NUC Kits before version PY0081 may allow a privileged user to potentially enable information disclosure or denial of service via local access

Published 2023-05-10 14:15:12

Updated 2023-06-01 17:20:20

Source Intel Corporation

View at NVD, CVE.org

Vulnerability category: Input validationDenial of serviceInformation leak

Products affected by CVE-2022-32577

Intel » Nuc5cpyh Firmware
Versions before (<) py0081
cpe:2.3:o:intel:nuc5cpyh_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Nuc5cpyh » Version: N/A
Intel » Nuc5pgyh Firmware
Versions before (<) py0081
cpe:2.3:o:intel:nuc5pgyh_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Nuc5pgyh » Version: N/A
Intel » Nuc5ppyh Firmware
Versions before (<) py0081
cpe:2.3:o:intel:nuc5ppyh_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Nuc5ppyh » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-32577

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 7 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-32577

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.0	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H	0.8	5.2	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: High
3.4	LOW	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N	0.8	2.5	Intel Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2022-32577

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-32577

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00777.html

INTEL-SA-00777
Patch;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-32577

Products affected by CVE-2022-32577

Exploit prediction scoring system (EPSS) score for CVE-2022-32577

CVSS scores for CVE-2022-32577

CWE ids for CVE-2022-32577

References for CVE-2022-32577