| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 5.5 | $0-$5k | 0.00 |
Summary
A vulnerability has been found in Intel Converged Security and Management Engine and classified as problematic. This impacts an unknown function. Performing a manipulation results in toctou. This vulnerability is identified as CVE-2025-20037. The attack is only possible with local access. There is not any exploit available. The affected component should be upgraded.
Details
A vulnerability classified as problematic has been found in Intel Converged Security and Management Engine (the affected version unknown). This affects an unknown part. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:
Time-of-check time-of-use race condition in firmware for some Intel(R) Converged Security and Management Engine may allow a privileged user to potentially enable escalation of privilege via local access.
The advisory is shared at intel.com. This vulnerability is uniquely identified as CVE-2025-20037 since 11/06/2024. The exploitability is told to be difficult. An attack has to be approached locally. The exploitation needs additional levels of successful authentication. Neither technical details nor an exploit are publicly available.
Upgrading eliminates this vulnerability. Intel recommends that each affected platform should be updated to its latest version. For more information, visit https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01280.html.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Product
Vendor
Name
License
Website
- Vendor: https://www.intel.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔒VulDB Reliability: 🔍
CNA CVSS-B Score: 🔒
CNA CVSS-BT Score: 🔒
CNA Vector: 🔒
CVSSv3
VulDB Meta Base Score: 5.5VulDB Meta Temp Score: 5.5
VulDB Base Score: 3.9
VulDB Temp Score: 3.8
VulDB Vector: 🔒
VulDB Reliability: 🔍
CNA Base Score: 7.2
CNA Vector (intel): 🔒
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: ToctouCWE: CWE-367 / CWE-362
CAPEC: 🔒
ATT&CK: 🔒
Physical: Partially
Local: Yes
Remote: No
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔒
Timeline
11/06/2024 CVE reserved08/12/2025 Advisory disclosed
08/12/2025 VulDB entry created
02/03/2026 VulDB entry last update
Sources
Vendor: intel.comAdvisory: intel-sa-01280
Status: Confirmed
CVE: CVE-2025-20037 (🔒)
GCVE (CVE): GCVE-0-2025-20037
GCVE (VulDB): GCVE-100-319581
Entry
Created: 08/12/2025 19:14Updated: 02/03/2026 14:55
Changes: 08/12/2025 19:14 (72), 02/03/2026 14:52 (2), 02/03/2026 14:55 (3)
Complete: 🔍
Committer: lywand
Cache ID: 216::103
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
No comments yet. Languages: en.
Please log in to comment.