Unquoted Search Path Vulnerability in Intel Server Firmware Update Utility
CVE-2023-22841

6.7MEDIUM

Key Information:

Vendor

Intel
Status
System Firmware Update Utility (sysfwupdt) For Some Intel(r) Server Boards And Intel(r) Server Systems Based On Intel(r) 621a Chipset
Vendor
CVE Published:
11 August 2023

What is CVE-2023-22841?

The software installer for the System Firmware Update Utility (SysFwUpdt) on certain Intel Server Boards and Intel Server Systems, specifically those based on the Intel 621A Chipset and versions preceding 16.0.7, contains an unquoted search path vulnerability. This flaw may allow an authenticated user to leverage local access to potentially escalate their privileges, posing a security risk to the affected systems.

Affected Version(s)

System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(R) Server Systems Based on Intel(R) 621A Chipset before version 16.0.7

References

http://www.intel.com/content/www/us/en/security-center/ad...

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.