CVE-2020-24516

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Modification of assumed-immutable data in subsystem in Intel(R) CSME versions before 13.0.47, 13.30.17, 14.1.53, 14.5.32, 15.0.22 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Intel(R) CSME versions	versions before 13.0.47, 13.30.17, 14.1.53, 14.5.32, 15.0.22

References

https://security.netapp.com/advisory/ntap-20210625-0008/Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.htmlVendor Advisory
https://security.netapp.com/advisory/ntap-20210625-0008/Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.htmlVendor Advisory

Timeline

Published: Jun 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-245257.8Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalati CVE-2020-245485.3Ericom Access Server 9.2.0 (for AccessNow and Ericom Blaze) allows SSRF to make outbound WebSocket connection requests on arbitrary TCP port CVE-2020-245498.8openMAINT before 1.1-2.4.2 allows remote authenticated users to run arbitrary JSP code on the underlying web server.CVE-2020-245506.1An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirec CVE-2020-245516.1IProom MMC+ Server login page does not validate specific parameters properly. Attackers can use the vulnerability to redirect to any malicio CVE-2020-245527.2Atop Technology industrial 3G/4G gateway contains Command Injection vulnerability. Due to insufficient input validation, the device's web ma CVE-2020-245536.1Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.CVE-2020-245547.5The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows CVE-2020-245567.8A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business Security Services on CVE-2020-245577.8A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a CVE-2020-245587.1A vulnerability in an Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services dll may allow an CVE-2020-245597.8A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow