CVE-2022-36339 : Improper input validation in firmware for Intel(R) NUC 8 Compute Element, Intel(

Improper input validation in firmware for Intel(R) NUC 8 Compute Element, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element may allow a privileged user to enable escalation of privilege via local access.

Published 2023-05-10 14:15:13

Updated 2023-05-22 14:19:32

Source Intel Corporation

View at NVD, CVE.org

Products affected by CVE-2022-36339

Intel » Cm8i3cb4n Firmware
Versions before (<) cbwhl357.0101
cpe:2.3:o:intel:cm8i3cb4n_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Cm8i3cb4n » Version: N/A
Intel » Cm8i5cb8n Firmware
Versions before (<) cbwhl357.0101
cpe:2.3:o:intel:cm8i5cb8n_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Cm8i5cb8n » Version: N/A
Intel » Cm8i7cb8n Firmware
Versions before (<) cbwhl357.0101
cpe:2.3:o:intel:cm8i7cb8n_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Cm8i7cb8n » Version: N/A
Intel » Cm8ccb4r Firmware
Versions before (<) cbwhl357.0101
cpe:2.3:o:intel:cm8ccb4r_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Cm8ccb4r » Version: N/A
Intel » Cm8pcb4r Firmware
Versions before (<) cbwhl357.0101
cpe:2.3:o:intel:cm8pcb4r_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Cm8pcb4r » Version: N/A
Intel » Cm11ebi38w Firmware
Versions before (<) ebtgl357.0071
cpe:2.3:o:intel:cm11ebi38w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Cm11ebi38w » Version: N/A
Intel » Cm11ebi58w Firmware
Versions before (<) ebtgl357.0071
cpe:2.3:o:intel:cm11ebi58w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Cm11ebi58w » Version: N/A
Intel » Cm11ebi716w Firmware
Versions before (<) ebtgl357.0071
cpe:2.3:o:intel:cm11ebi716w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Cm11ebi716w » Version: N/A
Intel » Cm11ebc4w Firmware
Versions before (<) ebtgl357.0071
cpe:2.3:o:intel:cm11ebc4w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Cm11ebc4w » Version: N/A
Intel » Elm12hbi3 Firmware
Versions before (<) hbadl357.0052
cpe:2.3:o:intel:elm12hbi3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Elm12hbi3 » Version: N/A
Intel » Elm12hbi5 Firmware
Versions before (<) hbadl357.0052
cpe:2.3:o:intel:elm12hbi5_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Elm12hbi5 » Version: N/A
Intel » Elm12hbi7 Firmware
Versions before (<) hbadl357.0052
cpe:2.3:o:intel:elm12hbi7_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Elm12hbi7 » Version: N/A
Intel » Elm12hbc Firmware
Versions before (<) hbadl357.0052
cpe:2.3:o:intel:elm12hbc_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Elm12hbc » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-36339

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 14 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-36339

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.5	HIGH	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	0.8	6.0	Intel Corporation
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

References for CVE-2022-36339

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00777.html

INTEL-SA-00777
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-36339

Products affected by CVE-2022-36339

Exploit prediction scoring system (EPSS) score for CVE-2022-36339

CVSS scores for CVE-2022-36339

References for CVE-2022-36339