CVE-2018-3632

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Memory corruption in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 6.x / 7.x / 8.x / 9.x / 10.x / 11.0 / 11.5 / 11.6 / 11.7 / 11.10 / 11.20 could be triggered by an attacker with local administrator permission on the system.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Intel Corporation	Intel Active Management Technology	3.x,4.x,5.x,6.x,7.x,8.x,9.x,10.x,11.x

References

http://www.securitytracker.com/id/1041362Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20190327-0001/Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03868en_usThird Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.htmlVendor Advisory
http://www.securitytracker.com/id/1041362Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20190327-0001/Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03868en_usThird Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.htmlVendor Advisory

Timeline

Published: Jul 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-36345.5Parameter corruption in NDIS filter driver in Intel Online Connect Access 1.9.22.0 allows an attacker to cause a denial of service via local CVE-2018-36357.8Insufficient input validation in installer in Intel Rapid Store Technology (RST) before version 16.7 may allow an unprivileged user to poten CVE-2018-36387.8Escalation of privilege in all versions of the Intel Remote Keyboard allows an authorized local attacker to execute arbitrary code as a priv CVE-2018-36395.5Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior mem CVE-2018-36405.6Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized d CVE-2018-36419.8Escalation of privilege in all versions of the Intel Remote Keyboard allows a network attacker to inject keystrokes as a local user.CVE-2018-36438.2A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) b CVE-2018-36457.8Escalation of privilege in all versions of the Intel Remote Keyboard allows a local attacker to inject keystrokes into another remote keyboa CVE-2018-36465.6Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information resid CVE-2018-36497.8DLL injection vulnerability in the installation executables (Autorun.exe and Setup.exe) for Intel's wireless drivers and related software in CVE-2018-36507.8Insufficient Input Validation in Bleach module in INTEL Distribution for Python versions prior to IDP 2018 Update 2 allows unprivileged user CVE-2018-36527.6Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon S