CVE-2019-11087

Published: Dec 18, 2019Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege, information disclosure or denial of service via local access.

Affected (8)

Products: Intel: Converged Security Management Engine Firmware, Trusted Execution Engine Firmware

Intel

2 products

Converged Security Management Engine Firmware

Trusted Execution Engine Firmware

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Intel Converged Security Management Engine Firmware	11.0 ≤ version < 11.8.70
Intel Converged Security Management Engine Firmware	11.10 ≤ version < 11.11.70
Intel Converged Security Management Engine Firmware	11.20 ≤ version < 11.22.70
Intel Converged Security Management Engine Firmware	12.0 ≤ version < 12.0.45
Intel Converged Security Management Engine Firmware	13.0 ≤ version < 13.0.10
Intel Converged Security Management Engine Firmware	14.0.0 ≤ version < 14.0.10
Intel Trusted Execution Engine Firmware	3.0 ≤ version < 3.1.70
Intel Trusted Execution Engine Firmware	4.0 ≤ version < 4.0.20

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html

Source: secure@intel.com

Vendor Advisory

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.