Intel CIP Software prior 2.4.0.11001 privileges management

Summaryinfo

A vulnerability identified as critical has been detected in Intel CIP Software. Affected by this issue is some unknown functionality. Performing a manipulation results in privileges management. This vulnerability was named CVE-2025-24307. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Intel CIP Software. This affects some unknown functionality. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable data manipulation. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

The advisory is shared at intel.com. This vulnerability is uniquely identified as CVE-2025-24307 since 01/30/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Additional levels of successful authentication are necessary for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/14/2025). MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 2.4.0.11001 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-93524). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Intel

Name

• CIP Software

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion