CVE Vulnerabilities

CVE-2020-12336

Insecure Default Initialization of Resource

Published: Nov 12, 2020 | Modified: Jul 21, 2021
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
4.6 MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Insecure default variable initialization in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access.

Weakness

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

Affected Software

Name Vendor Start Version End Version
Nuc_8_mainstream-g_kit_nuc8i5inh_firmware Intel inwhl357.0036 (including) inwhl357.0036 (including)

Extended Description

Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value. However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.

References