CVE-2020-8745

Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*
cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*
cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*
cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*
cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*
cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:intel:trusted_execution_technology:*:*:*:*:*:*:*:*
cpe:2.3:a:intel:trusted_execution_technology:*:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:siemens:simatic_drive_controller_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_drive_controller:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:siemens:simatic_et200sp_1515sp_pc2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_et200sp_1515sp_pc2:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:siemens:simatic_field_pg_m6_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_field_pg_m6:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:siemens:simatic_ipc127e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_ipc127e:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_ipc477e_pro:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:siemens:simatic_ipc527g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_ipc527g:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:siemens:simatic_ipc547g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_ipc547g:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:siemens:simatic_ipc627e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_ipc627e:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:siemens:simatic_ipc647e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_ipc647e:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:siemens:simatic_ipc667e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_ipc667e:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:siemens:simatic_ipc847e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_ipc847e:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:siemens:sinumerik_828d_hw_pu.4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinumerik_828d_hw_pu.4:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:siemens:sinumerik_mc_mcu_1720_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinumerik_mc_mcu_1720:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:siemens:sinumerik_one_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinumerik_one:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:siemens:sinumerik_840d_sl_ht_10_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinumerik_840d_sl_ht_10:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:siemens:sinumerik_one_ncu_1740_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinumerik_one_ncu_1740:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:siemens:sinumerik_one_ppu_1740_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinumerik_one_ppu_1740:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:39

Type Values Removed Values Added
References () https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf - Patch, Third Party Advisory () https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf - Patch, Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20201113-0002/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20201113-0002/ - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20201113-0005/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20201113-0005/ - Third Party Advisory
References () https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391 - Vendor Advisory () https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391 - Vendor Advisory

Information

Published : 2020-11-12 18:15

Updated : 2024-11-21 05:39


NVD link : CVE-2020-8745

Mitre link : CVE-2020-8745

CVE.ORG link : CVE-2020-8745


JSON object : View

Products Affected

siemens

  • simatic_ipc427e
  • simatic_ipc527g
  • simatic_ipc627e
  • simatic_et200sp_1515sp_pc2_firmware
  • simatic_ipc477e
  • simatic_field_pg_m6
  • simatic_field_pg_m5
  • simatic_ipc527g_firmware
  • sinumerik_one_firmware
  • simatic_ipc647e_firmware
  • sinumerik_one_ppu_1740_firmware
  • simatic_ipc127e_firmware
  • simatic_drive_controller_firmware
  • simatic_field_pg_m6_firmware
  • simatic_drive_controller
  • simatic_itp1000_firmware
  • simatic_ipc627e_firmware
  • simatic_ipc547g_firmware
  • simatic_itp1000
  • sinumerik_840d_sl_ht_10
  • simatic_ipc547g
  • simatic_ipc847e_firmware
  • simatic_ipc667e
  • sinumerik_mc_mcu_1720
  • simatic_et200sp_1515sp_pc2
  • sinumerik_one_ncu_1740_firmware
  • simatic_ipc477e_pro
  • sinumerik_828d_hw_pu.4
  • simatic_field_pg_m5_firmware
  • sinumerik_one
  • simatic_ipc647e
  • sinumerik_one_ppu_1740
  • sinumerik_mc_mcu_1720_firmware
  • simatic_ipc667e_firmware
  • simatic_ipc127e
  • sinumerik_840d_sl_ht_10_firmware
  • simatic_ipc427e_firmware
  • sinumerik_828d_hw_pu.4_firmware
  • simatic_ipc847e
  • sinumerik_one_ncu_1740
  • simatic_ipc477e_firmware

intel

  • converged_security_and_manageability_engine
  • trusted_execution_technology