CVE Vulnerabilities

CVE-2020-12336

Initialization of a Resource with an Insecure Default

Published: Nov 12, 2020 | Modified: Nov 21, 2024
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
4.6 MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Insecure default variable initialization in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access.

Weakness

The product initializes or sets a resource with a default that is intended to be changed by the product’s installer, administrator, or maintainer, but the default is not secure.

Affected Software

Name Vendor Start Version End Version
Nuc_8_mainstream-g_kit_nuc8i5inh_firmware Intel inwhl357.0036 (including) inwhl357.0036 (including)

References