Read the docs
TI-2020-09877 Aliases CVE-2020-12354GHSA-m679-wwqm-wjv6

Incorrect default permissions in Intel AMT SDK

Priority LOW 34CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Incorrect default permissions in Windows(R) installer in Intel(R) AMT SDK versions before 14.0.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

Why it matters now

EPSS 0.00336 27th percentileScored 2026-11-07
Fix Fixed Intel(R) AMT SDK: 14.0.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Intel(R) AMT SDKbefore 14.0.0.114.0.0.1Patch availableCNA
  • Intel(R) AMT SDK Vendor— Affected before 14.0.0.1 Fixed in 14.0.0.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:intel:active_management_technology_software_development_kit:*:*:*:*:*:*:*:*before 14.0.0.1VulnerableIntel
  • cpe:2.3:a:intel:active_management_technology_software_development_kit:*:*:*:*:*:*:*:* Versions before 14.0.0.1 Vulnerable ·Intel

Remediation

  • Fix · CNA Intel(R) AMT SDK Fixed in 14.0.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-12354
  2. 2026-10-03 Alias added: GHSA-m679-wwqm-wjv6

References

Advisory 2

  • TI-2022-09718 Insufficiently protected credentials in Intel AMT SDK, Intel EMA and Intel MC CVSS 3.1HIGH 8.8
  • TI-2021-12691 Insufficiently protected credentials in Intel AMT SDK before version 16.0.3, Intel SCS… CVSS 3.1MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences