SB2022081122 - Multiple vulnerabilities in Intel AMT and Standard Manageability

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Insufficiently protected credentials (CVE-ID: CVE-2022-30601)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficiently protected credentials. A remote attacker can obtain credentials and gain elevated privileges on the system.

2) Insufficiently protected credentials (CVE-ID: CVE-2022-30944)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to insufficiently protected credentials. A local administrator can obtain credentials on the system.

3) Improper access control (CVE-ID: CVE-2022-28697)

The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in firmware. An attacker with physical access can bypass implemented security restrictions and gain elevated privileges on the system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00709.html