CVE-2018-3643

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55, 11.21.55, 12.0.6 or Intel(R) Server Platform Services firmware before version 4.x.04 may allow an attacker with administrative privileges to uncover certain platform secrets via local access or to potentially execute arbitrary code.

Metrics

CVSS 3.0 8.2/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Intel Corporation	Intel(R) Converged Security and Management Engine (CSME) and Intel(R) Server Platform Services firmware	CSME versions before 12.0.6 or Server Platform Services firmware before version 4.x.04.

References

https://security.netapp.com/advisory/ntap-20180924-0002/Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03873en_usPatch, Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00131.htmlVendor Advisory
https://security.netapp.com/advisory/ntap-20180924-0002/Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03873en_usPatch, Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00131.htmlVendor Advisory

Timeline

Published: Sep 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-36457.8Escalation of privilege in all versions of the Intel Remote Keyboard allows a local attacker to inject keystrokes into another remote keyboa CVE-2018-36465.6Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information resid CVE-2018-36497.8DLL injection vulnerability in the installation executables (Autorun.exe and Setup.exe) for Intel's wireless drivers and related software in CVE-2018-36507.8Insufficient Input Validation in Bleach module in INTEL Distribution for Python versions prior to IDP 2018 Update 2 allows unprivileged user CVE-2018-36527.6Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon S CVE-2018-36557.3A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Ex CVE-2018-36576.7Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may allow a privileged user to potentially exec CVE-2018-36585.3Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with Intel AMT provisione CVE-2018-36596.8A vulnerability in Intel PTT module in Intel CSME firmware before version 12.0.5 and Intel TXE firmware before version 4.0 may allow an unau CVE-2018-36615.5Buffer overflow in Intel system Configuration utilities selview.exe and syscfg.exe before version 14 build 11 allows a local user to crash t CVE-2018-36628.0Escalation of privilege in Intel Saffron MemoryBase before version 11.4 potentially allows an authorized user of the Saffron application to CVE-2018-36635.7Escalation of privilege in Intel Saffron MemoryBase before 11.4 allows an authenticated user access to privileged information.