Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Intel Driver Update Utility can be hijacked to run code

CVE-2016-1493 · published 10 years ago
Summary

The Intel Driver Update Utility (versions before 2.4) downloads driver files without encrypting the connection. This allows an attacker who can intercept the network traffic to replace the file with malicious code, which could then be installed on the computer. Update the utility to the latest version or use a trusted network when running it.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
intel driver_update_utility 2.0
2.1
2.2
2.3
cpe:2.3:a:intel:driver_update_utility:2.0:*:*:*:*:*:*:*
Original advisory text
Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.
Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published29 Jan 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-1493 · NVD
Track software like this
Free during beta