Intel NUC up to FNCML357.0053 improper authentication

Summaryinfo

A vulnerability was found in Intel NUC. It has been declared as critical. This issue affects some unknown processing. The manipulation results in improper authentication. This vulnerability is reported as CVE-2022-21794. The attack requires a local approach. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Intel NUC. Affected is some unknown processing. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits before version HN0067 may allow a privileged user to potentially enable escalation of privilege via local access.

The weakness was disclosed 11/12/2022 as intel-sa-00752. The advisory is shared for download at intel.com. This vulnerability is traded as CVE-2022-21794 since 12/09/2021. There are neither technical details nor an exploit publicly available.

Upgrading to version HN0067 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Intel

Name

• NUC

Version

• 1.0.0.4
• 1.0.0.156
• 1.0.1.7
• 1.1
• 1.1.44
• 1.2.3
• 1.3
• 1.17.38.0
• 1.78.1.1
• 1.78.2.0.7
• 1.78.4.0.4
• 1.79.1.1
• 2.0.0.3
• 2.0.0.9
• 2.0.21.0
• 2.2.0.20
• 2.2.0.22
• 2.2.1.383
• 3.0.0.6
• 3.0.64.143
• 5.4.1.4449
• 5.13.00.2105
• 10.42
• 22.40
• 30.100.2104.1
• 156
• <=1.0
• <=1.2
• <=1.2.2
• <=1.78.1.0
• <=1.78.2.0.6
• <=10.41
• BC0076
• BCTGL357.0074
• CBWHL357.0096
• EBTGL357.0065
• FNCML357.0053

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion