Intel · Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability
CVE-2017-5689
Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability
What it is
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
CISA: Intel products contain a vulnerability which can allow attackers to perform privilege escalation.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: July 28, 2022
- Added to the CISA list
- January 28, 2022
- Published
- May 2, 2017
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 92% in the top 0.2% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (11)
- https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
- https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf
- http://www.securityfocus.com/bid/98269
- http://www.securitytracker.com/id/1038385
- https://security.netapp.com/advisory/ntap-20170509-0001/
- https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
- https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- https://www.embedi.com/news/mythbusters-cve-2017-5689
- https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf
More exploited flaws from Intel
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 10, 2023 | Denial-of-Service | Ethernet Diagnostics Driver for Windows | High 7.8 | 16% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.