Intel Endpoint Management Assistant software up to 1.14.4 input validation

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Intel Endpoint Management Assistant software up to 1.14.4. This vulnerability affects unknown code. This manipulation causes input validation. This vulnerability is handled as CVE-2025-35990. The attack can only be done within the local network. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Intel Endpoint Management Assistant software up to 1.14.4 and classified as very critical. Affected by this vulnerability is an unknown functionality. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Improper input validation for some Intel Endpoint Management Assistant (EMA) software before version 1.14.5 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

It is possible to read the advisory at intel.com. This vulnerability is known as CVE-2025-35990 since 04/15/2025. The exploitation appears to be easy. The attack can only be done within the local network. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 07/21/2026).

Upgrading to version 1.14.5 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Endpoint Management Software

Vendor

• Intel

Name

• Endpoint Management Assistant software

Version

• 1.14.0
• 1.14.1
• 1.14.2
• 1.14.3
• 1.14.4

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion