Intel PROSet/Wireless WiFi up to 21.69 on Windows 10 Permission privileges management

Summaryinfo

A vulnerability identified as critical has been detected in Intel PROSet and Wireless WiFi up to 21.69 on Windows 10. The impacted element is an unknown function of the component Permission. The manipulation leads to privileges management. This vulnerability is listed as CVE-2020-0557. The attack must be carried out locally. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Intel PROSet and Wireless WiFi up to 21.69 on Windows 10 (Wireless LAN Software) and classified as critical. This issue affects some unknown functionality of the component Permission. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Insecure inherited permissions in Intel(R) PROSet/Wireless WiFi products before version 21.70 on Windows 10 may allow an authenticated user to potentially enable escalation of privilege via local access.

The weakness was presented 04/15/2020. The identification of this vulnerability is CVE-2020-0557 since 10/28/2019. Attacking locally is a requirement. A simple authentication is required for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 21.70 eliminates this vulnerability.

See VDB-153744 for similar entry. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• Intel

Name

• PROSet
• Wireless WiFi

Version

• 21.0
• 21.1
• 21.2
• 21.3
• 21.4
• 21.5
• 21.6
• 21.7
• 21.8
• 21.9
• 21.10
• 21.11
• 21.12
• 21.13
• 21.14
• 21.15
• 21.16
• 21.17
• 21.18
• 21.19
• 21.20
• 21.21
• 21.22
• 21.23
• 21.24
• 21.25
• 21.26
• 21.27
• 21.28
• 21.29
• 21.30
• 21.31
• 21.32
• 21.33
• 21.34
• 21.35
• 21.36
• 21.37
• 21.38
• 21.39
• 21.40
• 21.41
• 21.42
• 21.43
• 21.44
• 21.45
• 21.46
• 21.47
• 21.48
• 21.49
• 21.50
• 21.51
• 21.52
• 21.53
• 21.54
• 21.55
• 21.56
• 21.57
• 21.58
• 21.59
• 21.60
• 21.61
• 21.62
• 21.63
• 21.64
• 21.65
• 21.66
• 21.67
• 21.68
• 21.69

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion