Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active…
Priority LOW 31Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain the TLS session key via the network.
Why it matters now
EPSS 0.02388 84th percentileScored 2026-11-07
Fix Fixed Intel(R) Active Management Technology (Intel Corporation): 12.0.5.
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Intel | Intel(R) Active Management Technology | before 12.0.5. | 12.0.5. | Patch available | CNA |
- Intel(R) Active Management Technology VendorIntel Affected before 12.0.5. Fixed in 12.0.5. Patch available CNA
CPE configurations NVD · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:intel:converged_security_management_engine_firmware:*:*:*:*:*:*:*:* | 11.0.0 to before 12.0.5 | Vulnerable | Intel |
| cpe:2.3:o:intel:active_management_technology_firmware:*:*:*:*:*:*:*:* | before 12.0.5 | Vulnerable | Intel |
| cpe:2.3:o:intel:manageability_engine_firmware:*:*:*:*:*:*:*:* | 9.0.0.0 to before 11.0 | Vulnerable | Intel |
| cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:* | before 22.01.06 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:* | before 21.01.09 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:* | before 21.01.09 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc547e_firmware:*:*:*:*:*:*:*:* | before r1.30.0 | Vulnerable | Siemens |
- cpe:2.3:a:intel:converged_security_management_engine_firmware:*:*:*:*:*:*:*:* Versions 11.0.0 to before 12.0.5 Vulnerable ·Intel
- cpe:2.3:o:intel:active_management_technology_firmware:*:*:*:*:*:*:*:* Versions before 12.0.5 Vulnerable ·Intel
- cpe:2.3:o:intel:manageability_engine_firmware:*:*:*:*:*:*:*:* Versions 9.0.0.0 to before 11.0 Vulnerable ·Intel
- cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:* Versions before 22.01.06 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:* Versions before 21.01.09 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:* Versions before 21.01.09 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc547e_firmware:*:*:*:*:*:*:*:* Versions before r1.30.0 Vulnerable ·Siemens
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:siemens:simatic_pc547e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_pc547g_firmware:*:*:*:*:*:*:*:* | before r1.23.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc547g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc627d_firmware:*:*:*:*:*:*:*:* | before 19.02.11 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc627d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc647d_firmware:*:*:*:*:*:*:*:* | before 19.01.14 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc647d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc677d_firmware:*:*:*:*:*:*:*:* | before 19.02.11 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc677d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc827d_firmware:*:*:*:*:*:*:*:* | before 19.02.11 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc827d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc847d_firmware:*:*:*:*:*:*:*:* | before 19.01.14 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc847d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:* | before 23.01.04 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:h:siemens:simatic_pc547e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_pc547g_firmware:*:*:*:*:*:*:*:* Versions before r1.23.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc547g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc627d_firmware:*:*:*:*:*:*:*:* Versions before 19.02.11 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc627d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc647d_firmware:*:*:*:*:*:*:*:* Versions before 19.01.14 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc647d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc677d_firmware:*:*:*:*:*:*:*:* Versions before 19.02.11 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc677d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc827d_firmware:*:*:*:*:*:*:*:* Versions before 19.02.11 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc827d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc847d_firmware:*:*:*:*:*:*:*:* Versions before 19.01.14 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc847d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:* Versions before 23.01.04 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA Intel(R) Active Management Technology (Intel Corporation) Fixed in 12.0.5.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-3616
- 2026-10-03 Alias added: GHSA-7gp5-m68f-f3xp
References
More Intel Active Management Technology Firmware vulnerabilities
- TI-2017-03684 Improper privilege management in Intel Active Mangement Technology, Intel Small Business… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-12740 Insufficiently protected credentials in Intel AMT and Intel Standard Manageability CVSS 3.1CRITICAL 9.8
- TI-2020-00572 Use after free in Intel AMT and Intel ISM CVSS 3.1CRITICAL 9.8
- TI-2020-00571 Out-of-bounds read in Intel AMT and Intel ISM CVSS 3.1CRITICAL 9.8
- TI-2020-07022 Improper buffer restrictions in network subsystem in provisioned Intel(R) AMT and… CVSS 3.1CRITICAL 9.8
- TI-2019-08330 Logic issue in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-3616 · CVE Program
- CVE-2018-3616 · NVD
- FIRST EPSS
- GHSA-7gp5-m68f-f3xp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences