Memory corruption in Intel Active Management Technology
Priority LOW 30CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may allow a privileged user to potentially execute arbitrary code with Intel AMT execution privilege via local access.
Why it matters now
EPSS 0.0059 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Intel | Intel(R) Active Management Technology | Versions before version 12.0.5. | — | No fix listed | CNA |
- Intel(R) Active Management Technology VendorIntel Affected Versions before version 12.0.5. Fixed in — No fix listed CNA
CPE configurations NVD · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:* | before 22.01.06 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:* | before 21.01.09 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:* | before 21.01.09 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc547e_firmware:*:*:*:*:*:*:*:* | before r1.30.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_pc547e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_pc547g_firmware:*:*:*:*:*:*:*:* | before r1.23.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc547g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:* Versions before 22.01.06 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:* Versions before 21.01.09 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:* Versions before 21.01.09 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc547e_firmware:*:*:*:*:*:*:*:* Versions before r1.30.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_pc547e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_pc547g_firmware:*:*:*:*:*:*:*:* Versions before r1.23.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc547g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_ipc627d_firmware:*:*:*:*:*:*:*:* | before 19.02.11 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc627d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc647d_firmware:*:*:*:*:*:*:*:* | before 19.01.14 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc647d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc677d_firmware:*:*:*:*:*:*:*:* | before 19.02.11 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc677d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc827d_firmware:*:*:*:*:*:*:*:* | before 19.02.11 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc827d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc847d_firmware:*:*:*:*:*:*:*:* | before 19.01.14 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc847d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:* | before 23.01.04 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:a:intel:converged_security_management_engine_firmware:*:*:*:*:*:*:*:* | 11.0.0 to before 12.0.5 | Vulnerable | Intel |
| cpe:2.3:o:intel:active_management_technology_firmware:*:*:*:*:*:*:*:* | before 12.0.5 | Vulnerable | Intel |
| cpe:2.3:o:intel:manageability_engine_firmware:*:*:*:*:*:*:*:* | 9.0.0.0 to before 11.0 | Vulnerable | Intel |
- cpe:2.3:o:siemens:simatic_ipc627d_firmware:*:*:*:*:*:*:*:* Versions before 19.02.11 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc627d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc647d_firmware:*:*:*:*:*:*:*:* Versions before 19.01.14 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc647d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc677d_firmware:*:*:*:*:*:*:*:* Versions before 19.02.11 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc677d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc827d_firmware:*:*:*:*:*:*:*:* Versions before 19.02.11 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc827d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc847d_firmware:*:*:*:*:*:*:*:* Versions before 19.01.14 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc847d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:* Versions before 23.01.04 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:a:intel:converged_security_management_engine_firmware:*:*:*:*:*:*:*:* Versions 11.0.0 to before 12.0.5 Vulnerable ·Intel
- cpe:2.3:o:intel:active_management_technology_firmware:*:*:*:*:*:*:*:* Versions before 12.0.5 Vulnerable ·Intel
- cpe:2.3:o:intel:manageability_engine_firmware:*:*:*:*:*:*:*:* Versions 9.0.0.0 to before 11.0 Vulnerable ·Intel
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-3657
- 2026-10-03 Alias added: GHSA-8rgp-cgf3-c9q6
References
More Intel Active Management Technology Firmware vulnerabilities
- TI-2017-03684 Improper privilege management in Intel Active Mangement Technology, Intel Small Business… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-12740 Insufficiently protected credentials in Intel AMT and Intel Standard Manageability CVSS 3.1CRITICAL 9.8
- TI-2020-00572 Use after free in Intel AMT and Intel ISM CVSS 3.1CRITICAL 9.8
- TI-2020-00571 Out-of-bounds read in Intel AMT and Intel ISM CVSS 3.1CRITICAL 9.8
- TI-2020-07022 Improper buffer restrictions in network subsystem in provisioned Intel(R) AMT and… CVSS 3.1CRITICAL 9.8
- TI-2019-08330 Logic issue in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-3657 · CVE Program
- CVE-2018-3657 · NVD
- FIRST EPSS
- GHSA-8rgp-cgf3-c9q6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences