Vulnerability Description
Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Intel | Nuc 8 Mainstream-G Kit Nuc8I5Inh Firmware | inwhl357.0036 |
| Intel | Nuc 8 Mainstream-G Kit Nuc8I5Inh | - |
| Intel | Nuc 8 Mainstream-G Kit Nuc8I7Inh Firmware | inwhl357.0036 |
| Intel | Nuc 8 Mainstream-G Kit Nuc8I7Inh | - |
| Intel | Nuc 8 Mainstream-G Mini Pc Nuc8I5Inh Firmware | inwhl357.0036 |
| Intel | Nuc 8 Mainstream-G Mini Pc Nuc8I5Inh | - |
| Intel | Nuc 8 Mainstream-G Mini Pc Nuc8I7Inh Firmware | inwhl357.0036 |
| Intel | Nuc 8 Mainstream-G Mini Pc Nuc8I7Inh | - |
| Intel | Nuc 8 Pro Board Nuc8I3Pnb Firmware | pnwhl357.0037 |
| Intel | Nuc 8 Pro Board Nuc8I3Pnb | - |
| Intel | Nuc 8 Pro Kit Nuc8I3Pnh Firmware | pnwhl357.0037 |
| Intel | Nuc 8 Pro Kit Nuc8I3Pnh | - |
| Intel | Nuc 8 Pro Kit Nuc8I3Pnk Firmware | pnwhl357.0037 |
| Intel | Nuc 8 Pro Kit Nuc8I3Pnk | - |
| Intel | Nuc 8 Pro Mini Pc Nuc8I3Pnk Firmware | pnwhl357.0037 |
| Intel | Nuc 8 Pro Mini Pc Nuc8I3Pnk | - |
| Intel | Nuc 8 Rugged Kit Nuc8Cchkr Firmware | chaplcel.0049 |
| Intel | Nuc 8 Rugged Kit Nuc8Cchkr | - |
| Intel | Nuc 9 Pro Kit Nuc9V7Qnx Firmware | qncflx70.34 |
| Intel | Nuc 9 Pro Kit Nuc9V7Qnx | - |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2020/Nov/26Mailing ListThird Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00414Vendor Advisory
- http://seclists.org/fulldisclosure/2020/Nov/26Mailing ListThird Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00414Vendor Advisory
FAQ
What is CVE-2020-24525?
CVE-2020-24525 is a vulnerability with a CVSS score of 7.8 (HIGH). Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access.
How severe is CVE-2020-24525?
CVE-2020-24525 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-24525?
Check the references section above for vendor advisories and patch information. Affected products include: Intel Nuc 8 Mainstream-G Kit Nuc8I5Inh Firmware, Intel Nuc 8 Mainstream-G Kit Nuc8I5Inh, Intel Nuc 8 Mainstream-G Kit Nuc8I7Inh Firmware, Intel Nuc 8 Mainstream-G Kit Nuc8I7Inh, Intel Nuc 8 Mainstream-G Mini Pc Nuc8I5Inh Firmware.