Read the docs
TI-2020-15029 Aliases CVE-2020-24525GHSA-r8m9-c8q4-99q2

Incorrect permission assignment in Intel NUCs

Priority LOW 34CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access.

Why it matters now

EPSS 0.00292 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Intel(R) NUCsSee references—No fix listedCNA
  • Intel(R) NUCs Vendor— Affected See references Fixed in — No fix listed CNA

CPE configurations NVD · 46

CPEVersionsRoleVendor
cpe:2.3:o:intel:nuc_8_mainstream-g_kit_nuc8i5inh_firmware:inwhl357.0036:*:*:*:*:*:*:*inwhl357.0036VulnerableIntel
cpe:2.3:h:intel:nuc_8_mainstream-g_kit_nuc8i5inh:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_8_mainstream-g_kit_nuc8i7inh_firmware:inwhl357.0036:*:*:*:*:*:*:*inwhl357.0036VulnerableIntel
cpe:2.3:h:intel:nuc_8_mainstream-g_kit_nuc8i7inh:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_8_mainstream-g_mini_pc_nuc8i5inh_firmware:inwhl357.0036:*:*:*:*:*:*:*inwhl357.0036VulnerableIntel
cpe:2.3:h:intel:nuc_8_mainstream-g_mini_pc_nuc8i5inh:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_8_mainstream-g_mini_pc_nuc8i7inh_firmware:inwhl357.0036:*:*:*:*:*:*:*inwhl357.0036VulnerableIntel
cpe:2.3:h:intel:nuc_8_mainstream-g_mini_pc_nuc8i7inh:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_8_pro_board_nuc8i3pnb_firmware:pnwhl357.0037:*:*:*:*:*:*:*pnwhl357.0037VulnerableIntel
cpe:2.3:h:intel:nuc_8_pro_board_nuc8i3pnb:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
  • cpe:2.3:o:intel:nuc_8_mainstream-g_kit_nuc8i5inh_firmware:inwhl357.0036:*:*:*:*:*:*:* Versions inwhl357.0036 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_8_mainstream-g_kit_nuc8i5inh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_8_mainstream-g_kit_nuc8i7inh_firmware:inwhl357.0036:*:*:*:*:*:*:* Versions inwhl357.0036 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_8_mainstream-g_kit_nuc8i7inh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_8_mainstream-g_mini_pc_nuc8i5inh_firmware:inwhl357.0036:*:*:*:*:*:*:* Versions inwhl357.0036 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_8_mainstream-g_mini_pc_nuc8i5inh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_8_mainstream-g_mini_pc_nuc8i7inh_firmware:inwhl357.0036:*:*:*:*:*:*:* Versions inwhl357.0036 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_8_mainstream-g_mini_pc_nuc8i7inh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_8_pro_board_nuc8i3pnb_firmware:pnwhl357.0037:*:*:*:*:*:*:* Versions pnwhl357.0037 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_8_pro_board_nuc8i3pnb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
Show 36 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:intel:nuc_8_pro_kit_nuc8i3pnh_firmware:pnwhl357.0037:*:*:*:*:*:*:*pnwhl357.0037VulnerableIntel
cpe:2.3:h:intel:nuc_8_pro_kit_nuc8i3pnh:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_8_pro_kit_nuc8i3pnk_firmware:pnwhl357.0037:*:*:*:*:*:*:*pnwhl357.0037VulnerableIntel
cpe:2.3:h:intel:nuc_8_pro_kit_nuc8i3pnk:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_8_pro_mini_pc_nuc8i3pnk_firmware:pnwhl357.0037:*:*:*:*:*:*:*pnwhl357.0037VulnerableIntel
cpe:2.3:h:intel:nuc_8_pro_mini_pc_nuc8i3pnk:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_8_rugged_kit_nuc8cchkr_firmware:chaplcel.0049:*:*:*:*:*:*:*chaplcel.0049VulnerableIntel
cpe:2.3:h:intel:nuc_8_rugged_kit_nuc8cchkr:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_9_pro_kit_nuc9v7qnx_firmware:qncflx70.34:*:*:*:*:*:*:*qncflx70.34VulnerableIntel
cpe:2.3:h:intel:nuc_9_pro_kit_nuc9v7qnx:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_9_pro_kit_nuc9vxqnx_firmware:qncflx70.34:*:*:*:*:*:*:*qncflx70.34VulnerableIntel
cpe:2.3:h:intel:nuc_9_pro_kit_nuc9vxqnx:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_board_h27002-400_firmware:tybyt10h.86a:*:*:*:*:*:*:*tybyt10h.86aVulnerableIntel
cpe:2.3:h:intel:nuc_board_h27002-400:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_board_h27002-401_firmware:tybyt10h.86a:*:*:*:*:*:*:*tybyt10h.86aVulnerableIntel
cpe:2.3:h:intel:nuc_board_h27002-401:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_board_h27002-402_firmware:tybyt10h.86a:*:*:*:*:*:*:*tybyt10h.86aVulnerableIntel
cpe:2.3:h:intel:nuc_board_h27002-402:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_board_h27002-404_firmware:tybyt10h.86a:*:*:*:*:*:*:*tybyt10h.86aVulnerableIntel
cpe:2.3:h:intel:nuc_board_h27002-404:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_board_h27002-500_firmware:tybyt20h.86a:*:*:*:*:*:*:*tybyt20h.86aVulnerableIntel
cpe:2.3:h:intel:nuc_board_h27002-500:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_board_nuc8cchb_firmware:chaplcel.0049:*:*:*:*:*:*:*chaplcel.0049VulnerableIntel
cpe:2.3:h:intel:nuc_board_nuc8cchb:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_kit_h26998-401_firmware:tybyt10h.86a:*:*:*:*:*:*:*tybyt10h.86aVulnerableIntel
cpe:2.3:h:intel:nuc_kit_h26998-401:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_kit_h26998-402_firmware:tybyt10h.86a:*:*:*:*:*:*:*tybyt10h.86aVulnerableIntel
cpe:2.3:h:intel:nuc_kit_h26998-402:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_kit_h26998-403_firmware:tybyt10h.86a:*:*:*:*:*:*:*tybyt10h.86aVulnerableIntel
cpe:2.3:h:intel:nuc_kit_h26998-403:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_kit_h26998-404_firmware:tybyt10h.86a:*:*:*:*:*:*:*tybyt10h.86aVulnerableIntel
cpe:2.3:h:intel:nuc_kit_h26998-404:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_kit_h26998-405_firmware:tybyt10h.86a:*:*:*:*:*:*:*tybyt10h.86aVulnerableIntel
cpe:2.3:h:intel:nuc_kit_h26998-405:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_kit_h26998-500_firmware:tybyt20h.86a:*:*:*:*:*:*:*tybyt20h.86aVulnerableIntel
cpe:2.3:h:intel:nuc_kit_h26998-500:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
  • cpe:2.3:o:intel:nuc_8_pro_kit_nuc8i3pnh_firmware:pnwhl357.0037:*:*:*:*:*:*:* Versions pnwhl357.0037 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_8_pro_kit_nuc8i3pnh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_8_pro_kit_nuc8i3pnk_firmware:pnwhl357.0037:*:*:*:*:*:*:* Versions pnwhl357.0037 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_8_pro_kit_nuc8i3pnk:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_8_pro_mini_pc_nuc8i3pnk_firmware:pnwhl357.0037:*:*:*:*:*:*:* Versions pnwhl357.0037 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_8_pro_mini_pc_nuc8i3pnk:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_8_rugged_kit_nuc8cchkr_firmware:chaplcel.0049:*:*:*:*:*:*:* Versions chaplcel.0049 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_8_rugged_kit_nuc8cchkr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_9_pro_kit_nuc9v7qnx_firmware:qncflx70.34:*:*:*:*:*:*:* Versions qncflx70.34 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_9_pro_kit_nuc9v7qnx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_9_pro_kit_nuc9vxqnx_firmware:qncflx70.34:*:*:*:*:*:*:* Versions qncflx70.34 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_9_pro_kit_nuc9vxqnx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_board_h27002-400_firmware:tybyt10h.86a:*:*:*:*:*:*:* Versions tybyt10h.86a Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_board_h27002-400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_board_h27002-401_firmware:tybyt10h.86a:*:*:*:*:*:*:* Versions tybyt10h.86a Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_board_h27002-401:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_board_h27002-402_firmware:tybyt10h.86a:*:*:*:*:*:*:* Versions tybyt10h.86a Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_board_h27002-402:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_board_h27002-404_firmware:tybyt10h.86a:*:*:*:*:*:*:* Versions tybyt10h.86a Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_board_h27002-404:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_board_h27002-500_firmware:tybyt20h.86a:*:*:*:*:*:*:* Versions tybyt20h.86a Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_board_h27002-500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_board_nuc8cchb_firmware:chaplcel.0049:*:*:*:*:*:*:* Versions chaplcel.0049 Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_board_nuc8cchb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_kit_h26998-401_firmware:tybyt10h.86a:*:*:*:*:*:*:* Versions tybyt10h.86a Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_kit_h26998-401:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_kit_h26998-402_firmware:tybyt10h.86a:*:*:*:*:*:*:* Versions tybyt10h.86a Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_kit_h26998-402:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_kit_h26998-403_firmware:tybyt10h.86a:*:*:*:*:*:*:* Versions tybyt10h.86a Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_kit_h26998-403:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_kit_h26998-404_firmware:tybyt10h.86a:*:*:*:*:*:*:* Versions tybyt10h.86a Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_kit_h26998-404:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_kit_h26998-405_firmware:tybyt10h.86a:*:*:*:*:*:*:* Versions tybyt10h.86a Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_kit_h26998-405:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_kit_h26998-500_firmware:tybyt20h.86a:*:*:*:*:*:*:* Versions tybyt20h.86a Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_kit_h26998-500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-24525
  2. 2026-10-03 Alias added: GHSA-r8m9-c8q4-99q2

References

Advisory 2

  • TI-2021-12724 Improper access control in BIOS firmware for some Intel(R) NUCs before version… CVSS 3.1HIGH 8.2
  • TI-2023-13864 Improper input validation in Intel NUC BIOS firmware CVSS 3.1HIGH 7.8
  • TI-2020-09865 Insecure default variable initialization in firmware for some Intel(R) NUCs may allow an… CVSS 3.1HIGH 7.8
  • TI-2020-00514 Buffer overflow in Intel NUC Firmware CVSS 3.1HIGH 7.8
  • TI-2023-13236 Improper buffer restrictions for some Intel NUC BIOS firmware before version IN0048 may… CVSS 3.1HIGH 7.8
  • TI-2020-09866 Improper buffer restrictions in firmware for some Intel(R) NUCs may allow a privileged… CVSS 3.1MEDIUM 6.7
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences