Intel Server Update Utility Software up to 16.0.11 Firmware Update uncontrolled search path

Summaryinfo

A vulnerability identified as problematic has been detected in Intel Server Update Utility Software up to 16.0.11. Affected by this vulnerability is an unknown functionality of the component Firmware Update Handler. Performing a manipulation results in uncontrolled search path. This vulnerability is cataloged as CVE-2025-35969. The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Intel Server Update Utility Software up to 16.0.11. This affects some unknown functionality of the component Firmware Update Handler. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Uncontrolled search path for some Intel(R) Server Firmware Update Utility Software before version 16.0.12. within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

It is possible to read the advisory at intel.com. This vulnerability is uniquely identified as CVE-2025-35969 since 04/15/2025. The exploitability is told to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/12/2026). The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

Upgrading to version 16.0.12 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Intel

Name

• Server Update Utility Software

Version

• 16.0.0
• 16.0.1
• 16.0.2
• 16.0.3
• 16.0.4
• 16.0.5
• 16.0.6
• 16.0.7
• 16.0.8
• 16.0.9
• 16.0.10
• 16.0.11

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion