Exposure of sensitive system information due to uncleared debug information in firmware…
Priority LOW 32CWE-212Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC Products may allow an unauthenticated user to potentially enable information disclosure or escalation of privilege via physical access.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00263 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC Products | See references | — | No fix listed | CNA |
- Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC Products Vendor— Affected See references Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:intel:optane_ssd_dc_p4800x_firmware:*:*:*:*:*:*:*:* | before e2010600 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_dc_p4800x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_ssd_dc_p4801x_firmware:*:*:*:*:*:*:*:* | before e2010600 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_dc_p4801x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_ssd_p5800x_firmware:*:*:*:*:*:*:*:* | before l0310200 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_p5800x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_memory_h20_with_solid_state_storage_firmware:*:*:*:*:*:*:*:* | before pgf028k | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_memory_h20_with_solid_state_storage:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_memory_h10_with_solid_state_storage_firmware:*:*:*:*:*:*:*:* | before tgf061k | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_memory_h10_with_solid_state_storage:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
- cpe:2.3:o:intel:optane_ssd_dc_p4800x_firmware:*:*:*:*:*:*:*:* Versions before e2010600 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_dc_p4800x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_ssd_dc_p4801x_firmware:*:*:*:*:*:*:*:* Versions before e2010600 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_dc_p4801x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_ssd_p5800x_firmware:*:*:*:*:*:*:*:* Versions before l0310200 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_p5800x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_memory_h20_with_solid_state_storage_firmware:*:*:*:*:*:*:*:* Versions before pgf028k Vulnerable ·Intel
- cpe:2.3:h:intel:optane_memory_h20_with_solid_state_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_memory_h10_with_solid_state_storage_firmware:*:*:*:*:*:*:*:* Versions before tgf061k Vulnerable ·Intel
- cpe:2.3:h:intel:optane_memory_h10_with_solid_state_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:intel:optane_ssd_905p_firmware:*:*:*:*:*:*:*:* | before fw600 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_905p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_ssd_900p_firmware:*:*:*:*:*:*:*:* | before fw600 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_900p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
- cpe:2.3:o:intel:optane_ssd_905p_firmware:*:*:*:*:*:*:*:* Versions before fw600 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_905p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_ssd_900p_firmware:*:*:*:*:*:*:*:* Versions before fw600 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_900p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33080
- 2026-10-03 Alias added: GHSA-qmqw-hp6j-fxqv
References
More Intel Optane Memory H10 With Solid State Storage Firmware vulnerabilities
- TI-2021-12666 Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R)… CVSS 3.1MEDIUM 6.8
- TI-2021-12660 Improper resource shutdown or release in firmware for some Intel(R) SSD, Intel(R) SSD DC… CVSS 3.1MEDIUM 5.5
- TI-2021-12671 Sensitive information in resource not removed before reuse in firmware for some Intel(R)… CVSS 3.1MEDIUM 4.6
- TI-2021-12667 Race condition in Intel Optane SSD and Intel SSD DC Products CVSS 3.1MEDIUM 4.7
- TI-2021-12664 Race condition in Intel Optane SSD, Intel Optane SSD DC and Intel SSD DC Products CVSS 3.1MEDIUM 4.7
- TI-2021-12663 Protection mechanism failure in firmware for some Intel(R) SSD, Intel(R) SSD DC and… CVSS 3.1MEDIUM 4.6
Sources
- CVE-2021-33080 · CVE Program
- CVE-2021-33080 · NVD
- FIRST EPSS
- GHSA-qmqw-hp6j-fxqv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences