Insufficiently protected credentials in Intel Client SSDs and some Intel Data Center SSDs
Priority LOW 21CWE-522Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522.
Summary
Insufficiently protected credentialsin subsystem in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via physical access.
Why it matters now
EPSS 0.00333 26th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Intel(R) Client SSDs and some Intel(R) Data Center SSDs | See references | — | No fix listed | CNA |
- Intel(R) Client SSDs and some Intel(R) Data Center SSDs Vendor— Affected See references Fixed in — No fix listed CNA
CPE configurations NVD · 33
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:intel:ssd_pro_6000p_firmware:*:*:*:*:*:*:*:* | before psf131p | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_pro_6000p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_pro_5450s_firmware:*:*:*:*:*:*:*:* | before lhf005p | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_pro_5450s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_e_5100s_firmware:*:*:*:*:*:*:*:* | before lhf004e | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_e_5100s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_pro_5400s_firmware:*:*:*:*:*:*:*:* | before lbf017p | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_pro_5400s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_pro_7600p_firmware:*:*:*:*:*:*:*:* | before 005p | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_pro_7600p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
- cpe:2.3:o:intel:ssd_pro_6000p_firmware:*:*:*:*:*:*:*:* Versions before psf131p Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_pro_6000p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_pro_5450s_firmware:*:*:*:*:*:*:*:* Versions before lhf005p Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_pro_5450s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_e_5100s_firmware:*:*:*:*:*:*:*:* Versions before lhf004e Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_e_5100s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_pro_5400s_firmware:*:*:*:*:*:*:*:* Versions before lbf017p Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_pro_5400s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_pro_7600p_firmware:*:*:*:*:*:*:*:* Versions before 005p Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_pro_7600p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
Show 23 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:intel:ssd_760p_firmware:*:*:*:*:*:*:*:* | before 005c | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_760p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_e_6100p_firmware:*:*:*:*:*:*:*:* | before 005e | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_e_6100p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_660p_firmware:*:*:*:*:*:*:*:* | before 004c | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_660p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_ssd_905p_firmware:*:*:*:*:*:*:*:* | before e2010480 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_905p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_ssd_900p_firmware:*:*:*:*:*:*:*:* | before e2010480 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_900p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_dc_p4510_firmware:*:*:*:*:*:*:*:* | before vdv10170 | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_dc_p4510:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_dc_p4610_firmware:*:*:*:*:*:*:*:* | before vdv10170 | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_dc_p4610:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_dc_p4800x_firmware:*:*:*:*:*:*:*:* | before e2010485 | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_dc_p4800x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_dc_p4801x_firmware:*:*:*:*:*:*:*:* | before e2010485 | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_dc_p4801x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_dc_p4101_firmware:*:*:*:*:*:*:*:* | before 008d | Vulnerable | Intel |
| cpe:2.3:h:intel:ssd_dc_p4101:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:ssd_pro_5450s_firmware:*:*:*:*:*:*:*:* | before lhf0b3p | Vulnerable | Intel |
| cpe:2.3:o:intel:ssd_e_5100s_firmware:*:*:*:*:*:*:*:* | before lhf0ae3 | Vulnerable | Intel |
| cpe:2.3:o:intel:ssd_pro_5400s_firmware:*:*:*:*:*:*:*:* | before lsf043p | Vulnerable | Intel |
- cpe:2.3:o:intel:ssd_760p_firmware:*:*:*:*:*:*:*:* Versions before 005c Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_760p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_e_6100p_firmware:*:*:*:*:*:*:*:* Versions before 005e Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_e_6100p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_660p_firmware:*:*:*:*:*:*:*:* Versions before 004c Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_660p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_ssd_905p_firmware:*:*:*:*:*:*:*:* Versions before e2010480 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_905p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_ssd_900p_firmware:*:*:*:*:*:*:*:* Versions before e2010480 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_900p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_dc_p4510_firmware:*:*:*:*:*:*:*:* Versions before vdv10170 Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_dc_p4510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_dc_p4610_firmware:*:*:*:*:*:*:*:* Versions before vdv10170 Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_dc_p4610:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_dc_p4800x_firmware:*:*:*:*:*:*:*:* Versions before e2010485 Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_dc_p4800x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_dc_p4801x_firmware:*:*:*:*:*:*:*:* Versions before e2010485 Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_dc_p4801x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_dc_p4101_firmware:*:*:*:*:*:*:*:* Versions before 008d Vulnerable ·Intel
- cpe:2.3:h:intel:ssd_dc_p4101:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:ssd_pro_5450s_firmware:*:*:*:*:*:*:*:* Versions before lhf0b3p Vulnerable ·Intel
- cpe:2.3:o:intel:ssd_e_5100s_firmware:*:*:*:*:*:*:*:* Versions before lhf0ae3 Vulnerable ·Intel
- cpe:2.3:o:intel:ssd_pro_5400s_firmware:*:*:*:*:*:*:*:* Versions before lsf043p Vulnerable ·Intel
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-12309
- 2026-10-03 Alias added: GHSA-gg2h-9fwh-3vgv
References
More Intel Optane Ssd 900p Firmware vulnerabilities
- TI-2023-12244 Improper input validation in Intel Optane SSD products CVSS 3.1HIGH 7.8
- TI-2021-12669 Exposure of sensitive system information due to uncleared debug information in firmware… CVSS 3.1MEDIUM 6.8
- TI-2021-12666 Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R)… CVSS 3.1MEDIUM 6.8
- TI-2023-10205 Insufficient control flow management in firmware for some Intel(R) Optane(TM) SSD… CVSS 3.1MEDIUM 6.9
- TI-2023-12041 Improper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow… CVSS 3.1MEDIUM 6.5
- TI-2020-00563 Buffer overflow in Intel SSD DC P4800X and P4801X Series, Intel Optane SSD 900P and 905P… CVSS 3.1MEDIUM 6.2
Sources
- CVE-2020-12309 · CVE Program
- CVE-2020-12309 · NVD
- FIRST EPSS
- GHSA-gg2h-9fwh-3vgv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences