Vulnerability-Lookup

BDU:2025-11372 (CVE-2025-20067)

Vulnerability from fstec – Published: 2025-09-19 – Updated: 2025-09-19 – View on bdu.fstec.ru Fixed

Title

Уязвимость программного обеспечения удаленного управления и мониторинга системы Intel Converged Security and Manageability Engine (CSME) и программного обеспечения удаленного управления и мониторинга системы Intel Server Platform Services (SPS), связанная с манипулированием неизвестным входом приводящее к уязвимости несоответствия времени, позволяющая нарушителю раскрыть защищаемую информацию

Summary

Уязвимость программного обеспечения удаленного управления и мониторинга системы Intel Converged Security and Manageability Engine (CSME) и программного обеспечения удаленного управления и мониторинга системы Intel Server Platform Services (SPS) связана с манипулированием неизвестным входом приводящее к уязвимости несоответствия времени. Эксплуатация уязвимости может позволить нарушителю раскрыть защищаемую информацию

Severity

4.6 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:C/I:N/A:N

6.0 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

6.8 (Medium) CVSS 4.0


                      
                        CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Information gathering

Incidents

Being clarified

Remediation

Software update

CWE

CWE-208 - Утечка информации на основании временных расхождений

Aliases

CVE-2025-20067, INTEL-SA-01280

References

1 reference

URL
https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01280.html

Impacted products

50 products from 1 vendor

Vendors

Intel Corp.

Products

Intel Core Ultra Processor (Series 1), Intel Core Ultra Processors (Series 2), Intel 100 series, Intel 200 series, 6th Generation Intel Core, 7th Generation Intel Core, 8th Generation Intel Core, Intel 300 series, Intel C240 series, 9th Generation Intel Core, Intel Pentium Gold processor series (G54XXU), Intel Celeron Processor 4000 Series, 10th Generation Intel Core, Intel Pentium Silver Series, Intel Celeron N Series, Intel 400 series, 11th Generation Intel Core, Intel Xeon W Processor Family, Intel Pentium Gold Processor Family, Intel Celeron G Series, Intel 500 series, Intel C250 series, Intel Celeron processor 6000 series, Intel Xeon E Processor, Intel C740, 4th Gen Intel Xeon Scalable Processors, Intel Atom x6000E series, Intel Pentium N Series, Intel Pentium J Series, Intel Celeron J Series, Intel 600 series chipset, Intel 700 series chipset, Intel W790, 12th Generation Intel Core Processor Family, 13th Generation Intel Core Processor Family, Intel Xeon Gold Processors, 5th Generation Intel Core, Intel Processor N Series, Intel Atom E3900 Series, Intel Pentium Processor N4000, Intel Pentium Processor J4000, Intel Celeron Processor J3000, Intel Celeron Processor N3000, Intel Pentium processor J5000, Intel Pentium processor N5000 series, Intel Celeron Processor J4000, Intel Celeron Processor N4000, Intel C620A series, 3rd Gen Intel Xeon Scalable processor family, Intel Atom processor P5000 series

Versions

до 18.1.18 (Intel Core Ultra Processor (Series 1)), до 19.0.5 (Intel Core Ultra Processors (Series 2)), до 20.0.5 (Intel Core Ultra Processors (Series 2)), до 11.8.98 (Intel 100 series), до 11.8.98 (Intel 200 series), до 11.8.98 (6th Generation Intel Core), до 11.8.98 (7th Generation Intel Core), до 11.8.98 (8th Generation Intel Core), до 12.0.97 (Intel 300 series), до 12.0.97 (Intel C240 series), до 12.0.97 (8th Generation Intel Core), до 12.0.97 (9th Generation Intel Core), до 12.0.97 (Intel Pentium Gold processor series (G54XXU)), до 12.0.97 (Intel Celeron Processor 4000 Series), до 13.0.72 (10th Generation Intel Core), до 13.50.32 (Intel Pentium Silver Series), до 13.50.32 (Intel Celeron N Series), до 14.1.77 (Intel 400 series), до 14.1.77 (10th Generation Intel Core), до 14.1.77 (11th Generation Intel Core), до 14.1.77 (Intel Xeon W Processor Family), до 14.1.77 (Intel Pentium Gold Processor Family), до 14.1.77 (Intel Celeron G Series), до 14.5.57 (Intel 400 series), до 14.5.57 (10th Generation Intel Core), до 15.0.52 (Intel 500 series), до 15.0.52 (Intel C250 series), до 15.0.52 (11th Generation Intel Core), до 15.0.52 (Intel Xeon W Processor Family), до 15.0.52 (Intel Pentium Gold Processor Family), до 15.0.52 (Intel Celeron processor 6000 series), до 15.0.52 (Intel Xeon E Processor), до 15.20.23 (Intel C740), до 15.20.23 (4th Gen Intel Xeon Scalable Processors), до 15.40.37 (Intel Atom x6000E series), до 15.40.37 (Intel Pentium N Series), до 15.40.37 (Intel Pentium J Series), до 15.40.37 (Intel Celeron N Series), до 15.40.37 (Intel Celeron J Series), до 16.1.38 (Intel 600 series chipset), до 16.1.38 (Intel 700 series chipset), до 16.1.38 (Intel W790), до 16.1.38 (12th Generation Intel Core Processor Family), до 16.1.38 (13th Generation Intel Core Processor Family), до 16.1.38 (Intel Xeon W Processor Family), до 16.1.38 (Intel Xeon Gold Processors), до 16.1.38 (Intel Celeron G Series), до 16.11.23 (5th Generation Intel Core), до 16.50.20 (Intel 600 series chipset), до 16.50.20 (Intel Processor N Series), до 3.1.98 (Intel Atom E3900 Series), до 3.1.98 (Intel Pentium Processor N4000), до 3.1.98 (Intel Pentium Processor J4000), до 3.1.98 (Intel Celeron Processor J3000), до 3.1.98 (Intel Celeron Processor N3000), до 4.0.57 (Intel Pentium processor J5000), до 4.0.57 (Intel Pentium processor N5000 series), до 4.0.57 (Intel Celeron Processor J4000), до 4.0.57 (Intel Celeron Processor N4000), до SPS_E5_04.04.04.801.0 (Intel C620A series), до SPS_E5_04.04.04.801.0 (3rd Gen Intel Xeon Scalable processor family), до SPS_E3_05.01.05.101.0 (Intel C240 series), до SPS_E3_05.01.05.101.0 (Intel Xeon E Processor), до SPS_SoC-A_05.00.03.411.0 (Intel Atom processor P5000 series)

Product types

Firmware, Микропрограммный код аппаратных компонентов компьютера, ПО программно-аппаратных средств защиты, Appliance software

Mitigations

Использование рекомендаций производителя: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01280.html

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:N/A:N",
  "CVSS 3.0": "AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
  "CVSS 4.0": "AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Intel Corp.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 18.1.18 (Intel Core Ultra Processor (Series 1)), \u0434\u043e 19.0.5 (Intel Core Ultra Processors (Series 2)), \u0434\u043e 20.0.5 (Intel Core Ultra Processors (Series 2)), \u0434\u043e 11.8.98 (Intel 100 series), \u0434\u043e 11.8.98 (Intel 200 series), \u0434\u043e 11.8.98 (6th Generation Intel Core), \u0434\u043e 11.8.98 (7th Generation Intel Core), \u0434\u043e 11.8.98 (8th Generation Intel Core), \u0434\u043e 12.0.97 (Intel 300 series), \u0434\u043e 12.0.97 (Intel C240 series), \u0434\u043e 12.0.97 (8th Generation Intel Core), \u0434\u043e 12.0.97 (9th Generation Intel Core), \u0434\u043e 12.0.97 (Intel Pentium Gold processor series (G54XXU)), \u0434\u043e 12.0.97 (Intel Celeron Processor 4000 Series), \u0434\u043e 13.0.72 (10th Generation Intel Core), \u0434\u043e 13.50.32 (Intel Pentium Silver Series), \u0434\u043e 13.50.32 (Intel Celeron N Series), \u0434\u043e 14.1.77 (Intel 400 series), \u0434\u043e 14.1.77 (10th Generation Intel Core), \u0434\u043e 14.1.77 (11th Generation Intel Core), \u0434\u043e 14.1.77 (Intel Xeon W Processor Family), \u0434\u043e 14.1.77 (Intel Pentium Gold Processor Family), \u0434\u043e 14.1.77 (Intel Celeron G Series), \u0434\u043e 14.5.57 (Intel 400 series), \u0434\u043e 14.5.57 (10th Generation Intel Core), \u0434\u043e 15.0.52 (Intel 500 series), \u0434\u043e 15.0.52 (Intel C250 series), \u0434\u043e 15.0.52 (11th Generation Intel Core), \u0434\u043e 15.0.52 (Intel Xeon W Processor Family), \u0434\u043e 15.0.52 (Intel Pentium Gold Processor Family), \u0434\u043e 15.0.52 (Intel Celeron processor 6000 series), \u0434\u043e 15.0.52 (Intel Xeon E Processor), \u0434\u043e 15.20.23 (Intel C740), \u0434\u043e 15.20.23 (4th Gen Intel Xeon Scalable Processors), \u0434\u043e 15.40.37 (Intel Atom x6000E series), \u0434\u043e 15.40.37 (Intel Pentium N Series), \u0434\u043e 15.40.37 (Intel Pentium J Series), \u0434\u043e 15.40.37 (Intel Celeron N Series), \u0434\u043e 15.40.37 (Intel Celeron J Series), \u0434\u043e 16.1.38 (Intel 600 series chipset), \u0434\u043e 16.1.38 (Intel 700 series chipset), \u0434\u043e 16.1.38 (Intel W790), \u0434\u043e 16.1.38 (12th Generation Intel Core Processor Family), \u0434\u043e 16.1.38 (13th Generation Intel Core Processor Family), \u0434\u043e 16.1.38 (Intel Xeon W Processor Family), \u0434\u043e 16.1.38 (Intel Xeon Gold Processors), \u0434\u043e 16.1.38 (Intel Celeron G Series), \u0434\u043e 16.11.23 (5th Generation Intel Core), \u0434\u043e 16.50.20 (Intel 600 series chipset), \u0434\u043e 16.50.20 (Intel Processor N Series), \u0434\u043e 3.1.98 (Intel Atom E3900 Series), \u0434\u043e 3.1.98 (Intel Pentium Processor N4000), \u0434\u043e 3.1.98 (Intel Pentium Processor J4000), \u0434\u043e 3.1.98 (Intel Celeron Processor J3000), \u0434\u043e 3.1.98 (Intel Celeron Processor N3000), \u0434\u043e 4.0.57 (Intel Pentium processor J5000), \u0434\u043e 4.0.57 (Intel Pentium processor N5000 series), \u0434\u043e 4.0.57 (Intel Celeron Processor J4000), \u0434\u043e 4.0.57 (Intel Celeron Processor N4000), \u0434\u043e SPS_E5_04.04.04.801.0 (Intel C620A series), \u0434\u043e SPS_E5_04.04.04.801.0 (3rd Gen Intel Xeon Scalable processor family), \u0434\u043e SPS_E3_05.01.05.101.0 (Intel C240 series), \u0434\u043e SPS_E3_05.01.05.101.0 (Intel Xeon E Processor), \u0434\u043e SPS_SoC-A_05.00.03.411.0 (Intel Atom processor P5000 series)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://intel.com/content/www/us/en/security-center/advisory/intel-sa-01280.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "12.08.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "19.09.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "19.09.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-11372",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-20067, INTEL-SA-01280",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Intel Core Ultra Processor (Series 1), Intel Core Ultra Processors (Series 2), Intel 100 series, Intel 200 series, 6th Generation Intel Core, 7th Generation Intel Core, 8th Generation Intel Core, Intel 300 series, Intel C240 series, 9th Generation Intel Core, Intel Pentium Gold processor series (G54XXU), Intel Celeron Processor 4000 Series, 10th Generation Intel Core, Intel Pentium Silver Series, Intel Celeron N Series, Intel 400 series, 11th Generation Intel Core, Intel Xeon W Processor Family, Intel Pentium Gold Processor Family, Intel Celeron G Series, Intel 500 series, Intel C250 series, Intel Celeron processor 6000 series, Intel Xeon E Processor, Intel C740, 4th Gen Intel Xeon Scalable Processors, Intel Atom x6000E series, Intel Pentium N Series, Intel Pentium J Series, Intel Celeron J Series, Intel 600 series chipset, Intel 700 series chipset, Intel W790, 12th Generation Intel Core Processor Family, 13th Generation Intel Core Processor Family, Intel Xeon Gold Processors, 5th Generation Intel Core, Intel Processor N Series, Intel Atom E3900 Series, Intel Pentium Processor N4000, Intel Pentium Processor J4000, Intel Celeron Processor J3000, Intel Celeron Processor N3000, Intel Pentium processor J5000, Intel Pentium processor N5000 series, Intel Celeron Processor J4000, Intel Celeron Processor N4000, Intel C620A series, 3rd Gen Intel Xeon Scalable processor family, Intel Atom processor P5000 series",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Intel Converged Security and Manageability Engine (CSME) \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Intel Server Platform Services (SPS), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u0445\u043e\u0434\u043e\u043c \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0435 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0423\u0442\u0435\u0447\u043a\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0439 (CWE-208)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Intel Converged Security and Manageability Engine (CSME) \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Intel Server Platform Services (SPS) \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u0445\u043e\u0434\u043e\u043c \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0435 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01280.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434, \u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-208",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,6)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 4.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)"
}

CVE-2025-20067 (GCVE-0-2025-20067)

Vulnerability from cvelistv5 – Published: 2025-08-12 16:58 – Updated: 2025-08-12 18:25

Summary

Observable timing discrepancy in firmware for some Intel(R) CSME and Intel(R) SPS may allow a privileged user to potentially enable information disclosure via local access.

Severity

6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-12 18:25 UTC

CWE

Information Disclosure
CWE-208 - Observable Timing Discrepancy

Assigner

intel mitre root Scorecard

References

1 reference

URL	Tags
https://intel.com/content/www/us/en/security-cent…

Impacted products

1 product

Vendor	Product	Version
n/a	Intel(R) CSME and Intel(R) SPS	Affected: See references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20067",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-12T18:25:14.322998Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-12T18:25:53.025Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Intel(R) CSME and Intel(R) SPS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "See references"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Observable timing discrepancy in firmware for some Intel(R) CSME and Intel(R) SPS may allow a privileged user to potentially enable information disclosure via local access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en"
            },
            {
              "cweId": "CWE-208",
              "description": "Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-12T16:58:04.888Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01280.html",
          "url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01280.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2025-20067",
    "datePublished": "2025-08-12T16:58:04.888Z",
    "dateReserved": "2024-10-11T03:00:12.211Z",
    "dateUpdated": "2025-08-12T18:25:53.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2025-11372 (CVE-2025-20067)

CVE-2025-20067 (GCVE-0-2025-20067)

Tags

Sightings

Nomenclature

Related by attack behaviour