Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-3643: Intel CSME and Server Platform Services firmware may leak secrets

CVE-2018-3643 · published 8 years ago

Summary

Systems that run older Intel Converged Security and Management Engine firmware or Intel Server Platform Services firmware could let someone with admin rights see hidden system information or run unwanted code. This risk applies to versions before the listed updates. Update the firmware to the latest versions to close the gap.

What to do

Update intel converged_security_management_engine_firmware to version 12.0.6 or later.
Update intel server_platform_services_firmware to version 4.00.04 or later.

Affected software

Vendor	Product	Affected versions
intel	converged_security_management_engine_firmware	< 12.0.6 `cpe:2.3:o:intel:converged_security_management_engine_firmware::::::::`
intel	server_platform_services_firmware	< 4.00.04 `cpe:2.3:o:intel:server_platform_services_firmware::::::::`

Original advisory text

A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55, 11.21.55, 12.0.6 or Intel(R) Server Platform Services firmware before version 4.x.04 may allow an attacker with administrative privileges to uncover certain platform secrets via local access or to potentially execute arbitrary code.

References

https://security.netapp.com/advisory/ntap-20180924-0002/ Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpe... Patch Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00131.... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.2 High

Exploitation

<1% chance of attack within 30 days

Timeline

Published12 Sep 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-3643 · NVD

Track software like this

Free during beta