CVE-2019-0090

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Insufficient access control vulnerability in subsystem for Intel(R) CSME before versions 11.x, 12.0.35 Intel(R) TXE 3.x, 4.x, Intel(R) Server Platform Services 3.x, 4.x, Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Intel(R) Converged Security & Management Engine (CSME), Intel(R) Server Platform Services (SPS)	CSME before version 12.0.35, Intel(R) SPS before version SPS_E3_05.00.04.027.0

References

https://support.f5.com/csp/article/K59145983Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.htmlVendor Advisory
https://support.f5.com/csp/article/K59145983Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.htmlVendor Advisory

Timeline

Published: May 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-00917.8Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.CVE-2019-00926.8Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an CVE-2019-00934.4Insufficient data sanitization vulnerability in HECI subsystem for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and In CVE-2019-00944.3Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an CVE-2019-00968.0Out of bound write vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an authenticat CVE-2019-00974.9Insufficient input validation vulnerability in subsystem for Intel(R) AMT before version 12.0.35 may allow a privileged user to potentially CVE-2019-00986.8Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticat CVE-2019-00996.8Insufficient access control vulnerability in subsystem in Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated use CVE-2019-01019.8Authentication bypass in the Intel Unite(R) solution versions 3.2 through 3.3 may allow an unauthenticated user to potentially enable escala CVE-2019-01028.8Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated use CVE-2019-01035.5Insufficient file protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to CVE-2019-01045.5Insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user