Sensitive information in resource not removed before reuse in firmware for some Intel(R)…
Priority LOW 21CWE-212Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Sensitive information in resource not removed before reuse in firmware for some Intel(R) SSD and Intel(R) Optane(TM) SSD Products may allow an unauthenticated user to potentially enable information disclosure via physical access.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00265 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Intel(R) SSD and Intel(R) Optane(TM) SSD Products | See references | — | No fix listed | CNA |
- Intel(R) SSD and Intel(R) Optane(TM) SSD Products Vendor— Affected See references Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:intel:optane_ssd_dc_p4800x_firmware:*:*:*:*:*:*:*:* | before e2010600 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_dc_p4800x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_ssd_dc_p4801x_firmware:*:*:*:*:*:*:*:* | before e2010600 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_dc_p4801x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_ssd_p5800x_firmware:*:*:*:*:*:*:*:* | before l0310200 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_p5800x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_memory_h20_with_solid_state_storage_firmware:*:*:*:*:*:*:*:* | before pgf028k | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_memory_h20_with_solid_state_storage:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_memory_h10_with_solid_state_storage_firmware:*:*:*:*:*:*:*:* | before tgf061k | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_memory_h10_with_solid_state_storage:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
- cpe:2.3:o:intel:optane_ssd_dc_p4800x_firmware:*:*:*:*:*:*:*:* Versions before e2010600 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_dc_p4800x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_ssd_dc_p4801x_firmware:*:*:*:*:*:*:*:* Versions before e2010600 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_dc_p4801x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_ssd_p5800x_firmware:*:*:*:*:*:*:*:* Versions before l0310200 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_p5800x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_memory_h20_with_solid_state_storage_firmware:*:*:*:*:*:*:*:* Versions before pgf028k Vulnerable ·Intel
- cpe:2.3:h:intel:optane_memory_h20_with_solid_state_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_memory_h10_with_solid_state_storage_firmware:*:*:*:*:*:*:*:* Versions before tgf061k Vulnerable ·Intel
- cpe:2.3:h:intel:optane_memory_h10_with_solid_state_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:intel:optane_ssd_905p_firmware:*:*:*:*:*:*:*:* | before fw600 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_905p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
| cpe:2.3:o:intel:optane_ssd_900p_firmware:*:*:*:*:*:*:*:* | before fw600 | Vulnerable | Intel |
| cpe:2.3:h:intel:optane_ssd_900p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Intel |
- cpe:2.3:o:intel:optane_ssd_905p_firmware:*:*:*:*:*:*:*:* Versions before fw600 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_905p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
- cpe:2.3:o:intel:optane_ssd_900p_firmware:*:*:*:*:*:*:*:* Versions before fw600 Vulnerable ·Intel
- cpe:2.3:h:intel:optane_ssd_900p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33082
- 2026-10-03 Alias added: GHSA-r3xp-3wrm-g7w6
References
More Intel Optane Memory H10 With Solid State Storage Firmware vulnerabilities
- TI-2021-12669 Exposure of sensitive system information due to uncleared debug information in firmware… CVSS 3.1MEDIUM 6.8
- TI-2021-12666 Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R)… CVSS 3.1MEDIUM 6.8
- TI-2021-12660 Improper resource shutdown or release in firmware for some Intel(R) SSD, Intel(R) SSD DC… CVSS 3.1MEDIUM 5.5
- TI-2021-12667 Race condition in Intel Optane SSD and Intel SSD DC Products CVSS 3.1MEDIUM 4.7
- TI-2021-12664 Race condition in Intel Optane SSD, Intel Optane SSD DC and Intel SSD DC Products CVSS 3.1MEDIUM 4.7
- TI-2021-12663 Protection mechanism failure in firmware for some Intel(R) SSD, Intel(R) SSD DC and… CVSS 3.1MEDIUM 4.6
Sources
- CVE-2021-33082 · CVE Program
- CVE-2021-33082 · NVD
- FIRST EPSS
- GHSA-r3xp-3wrm-g7w6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences