CVE-2017-5689
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - secure@intel.com
- Published
- 2017-05-02
- Last modified
- 2025-10-21
- Known exploited (CISA KEV)
- since 2022-01-28, action due 2022-07-28: Apply updates per vendor instructions.
- Weaknesses
- CWE-269
Affected products
- Proliant Ml10 Gen9 Server Firmware (Hpe)
- Active Management Technology Firmware (Intel)
- Intel Active Mangement Technology (Intel Corporation)
- Intel Small Business Technology (Intel Corporation)
- Intel Standard Manageability (Intel Corporation)
- Simatic Field Pg M3 Firmware (Siemens)
- Simatic Field Pg M4 Firmware (Siemens)
- Simatic Field Pg M5 Firmware (Siemens)
- Simatic Ipc427d Firmware (Siemens)
- Simatic Ipc427e Firmware (Siemens)
- Simatic Ipc477d Firmware (Siemens)
- Simatic Ipc477e Firmware (Siemens)
- Simatic Ipc547d Firmware (Siemens)
- Simatic Ipc547e Firmware (Siemens)
- Simatic Ipc547g Firmware (Siemens)
- Simatic Ipc627c Firmware (Siemens)
- Simatic Ipc627d Firmware (Siemens)
- Simatic Ipc647c Firmware (Siemens)
- Simatic Ipc647d Firmware (Siemens)
- Simatic Ipc677c Firmware (Siemens)
- Simatic Ipc677d Firmware (Siemens)
- Simatic Ipc827c Firmware (Siemens)
- Simatic Ipc827d Firmware (Siemens)
- Simatic Ipc847c Firmware (Siemens)
- Simatic Ipc847d Firmware (Siemens)
- Simatic Itp1000 Firmware (Siemens)
- Simatic Pcs 7 Ipc427e Firmware (Siemens)
- Simatic Pcs 7 Ipc477d Firmware (Siemens)
- Simatic Pcs 7 Ipc547d Firmware (Siemens)
- Simatic Pcs 7 Ipc547e Firmware (Siemens)
- Simatic Pcs 7 Ipc547g Firmware (Siemens)
- Simatic Pcs 7 Ipc627c Firmware (Siemens)
- Simatic Pcs 7 Ipc647c Firmware (Siemens)
- Simatic Pcs 7 Ipc647d Firmware (Siemens)
- Simatic Pcs 7 Ipc677c Firmware (Siemens)
- Simatic Pcs 7 Ipc847c Firmware (Siemens)
- Simatic Pcs 7 Ipc847d Firmware (Siemens)
- Simotion P320-4 S Firmware (Siemens)
- Sinumerik Pcu50.5-p Firmware (Siemens)
References
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.securityfocus.com/bid/98269
- http://www.securitytracker.com/id/1038385
- https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf
- https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us
- https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
- https://security.netapp.com/advisory/ntap-20170509-0001/
- https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
- https://www.embedi.com/news/mythbusters-cve-2017-5689
- https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5689
