Insufficient control flow management in subsystem for Intel(R) CSME versions before…
Priority LOW 30Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Why it matters now
EPSS 0.00383 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Intel(R) CSME, Intel(R) TXE | Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 | — | No fix listed | CNA |
- Intel(R) CSME, Intel(R) TXE Vendor— Affected Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 Fixed in — No fix listed CNA
CPE configurations NVD · 43
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:* | before 11.8.80; 11.12.0 to before 11.12.80; 11.22.0 to before 11.22.80; 12.0 to before 12.0.70; 14.0 to before 14.0.45; 14.5.0 to before 14.5.25 | Vulnerable | Intel |
| cpe:2.3:a:intel:trusted_execution_technology:*:*:*:*:*:*:*:* | before 3.1.80; 4.0 to before 4.0.30 | Vulnerable | Intel |
| cpe:2.3:o:siemens:simatic_drive_controller_firmware:*:*:*:*:*:*:*:* | before 05.00.01.00 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_drive_controller:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_et200sp_1515sp_pc2_firmware:*:*:*:*:*:*:*:* | before 0209.0105 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_et200sp_1515sp_pc2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:* | before 22.01.08 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_field_pg_m6_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_field_pg_m6:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:* Versions before 11.8.80; 11.12.0 to before 11.12.80; 11.22.0 to before 11.22.80; 12.0 to before 12.0.70; 14.0 to before 14.0.45; 14.5.0 to before 14.5.25 Vulnerable ·Intel
- cpe:2.3:a:intel:trusted_execution_technology:*:*:*:*:*:*:*:* Versions before 3.1.80; 4.0 to before 4.0.30 Vulnerable ·Intel
- cpe:2.3:o:siemens:simatic_drive_controller_firmware:*:*:*:*:*:*:*:* Versions before 05.00.01.00 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_drive_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_et200sp_1515sp_pc2_firmware:*:*:*:*:*:*:*:* Versions before 0209.0105 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_et200sp_1515sp_pc2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:* Versions before 22.01.08 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_field_pg_m6_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_field_pg_m6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 33 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_ipc127e_firmware:*:*:*:*:*:*:*:* | before 27.01.05 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc127e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:* | before 27.01.05 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:* | before 21.01.15 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:simatic_ipc477e_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc527g_firmware:*:*:*:*:*:*:*:* | before 1.4.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc527g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc547g_firmware:*:*:*:*:*:*:*:* | before r1.30.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc547g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc627e_firmware:*:*:*:*:*:*:*:* | before 25.02.08 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc627e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc647e_firmware:*:*:*:*:*:*:*:* | before 25.02.08 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc647e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc667e_firmware:*:*:*:*:*:*:*:* | before 25.02.08 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc667e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_ipc847e_firmware:*:*:*:*:*:*:*:* | before 25.02.08 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_ipc847e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:* | before 23.01.08 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_828d_hw_pu.4_firmware:*:*:*:*:*:*:*:* | before 08.00.00.00 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_828d_hw_pu.4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_mc_mcu_1720_firmware:*:*:*:*:*:*:*:* | before 05.00.00.00 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_mc_mcu_1720:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_one_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_one:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_840d_sl_ht_10_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_840d_sl_ht_10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_one_ncu_1740_firmware:*:*:*:*:*:*:*:* | before 04.00.00.00 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_one_ncu_1740:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_one_ppu_1740_firmware:*:*:*:*:*:*:*:* | before 06.00.00.00 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_one_ppu_1740:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_ipc127e_firmware:*:*:*:*:*:*:*:* Versions before 27.01.05 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc127e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:* Versions before 27.01.05 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:* Versions before 21.01.15 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:simatic_ipc477e_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc527g_firmware:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc527g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc547g_firmware:*:*:*:*:*:*:*:* Versions before r1.30.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc547g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc627e_firmware:*:*:*:*:*:*:*:* Versions before 25.02.08 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc627e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc647e_firmware:*:*:*:*:*:*:*:* Versions before 25.02.08 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc647e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc667e_firmware:*:*:*:*:*:*:*:* Versions before 25.02.08 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc667e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_ipc847e_firmware:*:*:*:*:*:*:*:* Versions before 25.02.08 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_ipc847e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:* Versions before 23.01.08 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_828d_hw_pu.4_firmware:*:*:*:*:*:*:*:* Versions before 08.00.00.00 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_828d_hw_pu.4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_mc_mcu_1720_firmware:*:*:*:*:*:*:*:* Versions before 05.00.00.00 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_mc_mcu_1720:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_one_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_one:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_840d_sl_ht_10_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_840d_sl_ht_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_one_ncu_1740_firmware:*:*:*:*:*:*:*:* Versions before 04.00.00.00 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_one_ncu_1740:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_one_ppu_1740_firmware:*:*:*:*:*:*:*:* Versions before 06.00.00.00 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_one_ppu_1740:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8745
- 2026-10-03 Alias added: GHSA-wc8w-gx27-xp92
References
Sources
- CVE-2020-8745 · CVE Program
- CVE-2020-8745 · NVD
- FIRST EPSS
- GHSA-wc8w-gx27-xp92 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences