Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may…
Priority LOW 30CWE-772Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-772.
Summary
Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with Intel AMT provisioned to potentially cause a partial denial of service via network access.
Why it matters now
EPSS 0.03331 88th percentileScored 2026-11-07
Fix Fixed Intel(R) Active Management Technology (Intel Corporation): 12.0.5.
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Intel | Intel(R) Active Management Technology | before 12.0.5. | 12.0.5. | Patch available | CNA |
- Intel(R) Active Management Technology VendorIntel Affected before 12.0.5. Fixed in 12.0.5. Patch available CNA
CPE configurations NVD · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:* | before 22.01.06 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:* | before 21.01.09 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:* | before 21.01.09 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc547e_firmware:*:*:*:*:*:*:*:* | before r1.30.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_pc547e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_pc547g_firmware:*:*:*:*:*:*:*:* | before r1.23.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc547g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:* Versions before 22.01.06 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:* Versions before 21.01.09 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:* Versions before 21.01.09 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc547e_firmware:*:*:*:*:*:*:*:* Versions before r1.30.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_pc547e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_pc547g_firmware:*:*:*:*:*:*:*:* Versions before r1.23.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc547g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_ipc627d_firmware:*:*:*:*:*:*:*:* | before 19.02.11 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc627d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc647d_firmware:*:*:*:*:*:*:*:* | before 19.01.14 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc647d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc677d_firmware:*:*:*:*:*:*:*:* | before 19.02.11 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc677d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc827d_firmware:*:*:*:*:*:*:*:* | before 19.02.11 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc827d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc847d_firmware:*:*:*:*:*:*:*:* | before 19.01.14 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc847d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:* | before 23.01.04 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:a:intel:converged_security_management_engine_firmware:*:*:*:*:*:*:*:* | 11.0.0 to before 12.0.5 | Vulnerable | Intel |
| cpe:2.3:o:intel:active_management_technology_firmware:*:*:*:*:*:*:*:* | before 12.0.5 | Vulnerable | Intel |
| cpe:2.3:o:intel:manageability_engine_firmware:*:*:*:*:*:*:*:* | 9.0.0.0 to before 11.0 | Vulnerable | Intel |
- cpe:2.3:o:siemens:simatic_ipc627d_firmware:*:*:*:*:*:*:*:* Versions before 19.02.11 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc627d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc647d_firmware:*:*:*:*:*:*:*:* Versions before 19.01.14 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc647d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc677d_firmware:*:*:*:*:*:*:*:* Versions before 19.02.11 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc677d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc827d_firmware:*:*:*:*:*:*:*:* Versions before 19.02.11 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc827d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc847d_firmware:*:*:*:*:*:*:*:* Versions before 19.01.14 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc847d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:* Versions before 23.01.04 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:a:intel:converged_security_management_engine_firmware:*:*:*:*:*:*:*:* Versions 11.0.0 to before 12.0.5 Vulnerable ·Intel
- cpe:2.3:o:intel:active_management_technology_firmware:*:*:*:*:*:*:*:* Versions before 12.0.5 Vulnerable ·Intel
- cpe:2.3:o:intel:manageability_engine_firmware:*:*:*:*:*:*:*:* Versions 9.0.0.0 to before 11.0 Vulnerable ·Intel
Remediation
- Fix · CNA Intel(R) Active Management Technology (Intel Corporation) Fixed in 12.0.5.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-3658
- 2026-10-03 Alias added: GHSA-4xf8-qhpw-9g4c
References
More Intel Active Management Technology Firmware vulnerabilities
- TI-2017-03684 Improper privilege management in Intel Active Mangement Technology, Intel Small Business… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-12740 Insufficiently protected credentials in Intel AMT and Intel Standard Manageability CVSS 3.1CRITICAL 9.8
- TI-2020-00572 Use after free in Intel AMT and Intel ISM CVSS 3.1CRITICAL 9.8
- TI-2020-00571 Out-of-bounds read in Intel AMT and Intel ISM CVSS 3.1CRITICAL 9.8
- TI-2020-07022 Improper buffer restrictions in network subsystem in provisioned Intel(R) AMT and… CVSS 3.1CRITICAL 9.8
- TI-2019-08330 Logic issue in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-3658 · CVE Program
- CVE-2018-3658 · NVD
- FIRST EPSS
- GHSA-4xf8-qhpw-9g4c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences