CVE-2023-27504

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Improper conditions check in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-92

Affected software

VendorProductVersions
n/aIntel(R) BIOS Guard firmwareSee references
intelkaby_lake-
intelcoffee_lake-
intelcomet_lake-
intelice_lake-
intelrocket_lake-
inteltiger_lake-
intelamber_lake-
intelalder_lake-

References

Timeline

Published
May 16, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-275057.8Incorrect default permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installers before version 22.1 .1 may allow CVE-2023-275067.8Improper buffer restrictions in the Intel(R) Optimization for Tensorflow software before version 2.12 may allow an authenticated user to potCVE-2023-275079.8MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save oCVE-2023-275097.8Improper access control in some Intel(R) ISPC software installers before version 1.19.0 may allow an authenticated user to potentially enablCVE-2023-27515.3The Upload Resume WordPress plugin through 1.2.0 does not validate the captcha parameter when uploading a resume via the resume_upload_form CVE-2023-275107.5JB Inquiry form contains an exposure of private personal information to an unauthorized actor vulnerability, which may allow a remote unauthCVE-2023-275127.2Use of hard-coded credentials exists in SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10, and SV-CPT-MC310F versions prior to Ver.8CVE-2023-275137.8Uncontrolled search path element in some Intel(R) Server Information Retrieval Utility software before version 16.0.9 may allow an authenticCVE-2023-275148.8OS command injection vulnerability in the download page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versiCVE-2023-275159.6Cross-site scripting (XSS) for the Intel(R) DSA software before version 23.1.9 may allow unauthenticated user to potentially enable escalatiCVE-2023-275167.8An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A speciallCVE-2023-275177.8Improper access control in some Intel(R) Optane(TM) PMem software before versions 01.00.00.3547, 02.00.00.3915, 03.00.00.0483 may allow an a