CVE-2017-5689

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 92,2%

Kerentanan Improper Privilege Management pada hpe proliant ml10 gen9 server firmware, siemens simatic itp1000 firmware +34 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 28 Januari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

Rincian

Terbit di NVD

2 Mei 2017

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

92,2% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability

Masuk KEV

28 Januari 2022

Tenggat CISA

28 Juli 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr patch · advisory vendor
• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5689 pemerintah AS
• http://www.securityfocus.com/bid/98269 broken link · advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1038385 broken link · advisory pihak ketiga · vdb entry
• https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf advisory pihak ketiga
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20170509-0001/ advisory pihak ketiga
• https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf broken link · exploit · deskripsi teknis · advisory pihak ketiga
• https://www.embedi.com/news/mythbusters-cve-2017-5689 broken link · advisory pihak ketiga
• https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability deskripsi teknis · advisory pihak ketiga
• https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf broken link