CVE-2018-3624

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

Buffer overflow in ETWS processing module Intel XMM71xx, XMM72xx, XMM73xx, XMM74xx and Sofia 3G/R allows remote attacker to potentially execute arbitrary code via an adjacent network.

Metrics

CVSS 3.0 8.3/10CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Intel Corporation	Intel XMM71xx, Intel XMM72xx, Intel XMM73xx, Intel XMM74xx, Sofia 3G, Sofia 3G-R, and Sofia 3G-RW	All

References

http://www.securityfocus.com/bid/103968Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-114-02Third Party Advisory, US Government Resource
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00116&languageid=en-frVendor Advisory
http://www.securityfocus.com/bid/103968Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-114-02Third Party Advisory, US Government Resource
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00116&languageid=en-frVendor Advisory

Timeline

Published: Apr 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-36264.7Edger8r tool in the Intel SGX SDK before version 2.1.2 (Linux) and 1.9.6 (Windows) may generate code that is susceptible to a side channel p CVE-2018-36278.2Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access.CVE-2018-36288.8Buffer overflow in HTTP handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5.CVE-2018-36296.5Buffer overflow in event handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5 CVE-2018-36326.7Memory corruption in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 6.x / 7.x / 8.x / 9.x / 10 CVE-2018-36345.5Parameter corruption in NDIS filter driver in Intel Online Connect Access 1.9.22.0 allows an attacker to cause a denial of service via local CVE-2018-36357.8Insufficient input validation in installer in Intel Rapid Store Technology (RST) before version 16.7 may allow an unprivileged user to poten CVE-2018-36387.8Escalation of privilege in all versions of the Intel Remote Keyboard allows an authorized local attacker to execute arbitrary code as a priv CVE-2018-36395.5Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior mem CVE-2018-36405.6Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized d CVE-2018-36419.8Escalation of privilege in all versions of the Intel Remote Keyboard allows a network attacker to inject keystrokes as a local user.CVE-2018-36438.2A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) b