TI-2022-17415 Aliases CVE-2022-37341 GHSA-hh4g-rh5c-8w86

Improper access control in Intel Ethernet Adapters and Intel Ethernet Controller I225…

LOW 35CWE-284Published 2024-05-16 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00198 9th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware	See references	—	No fix listed	CNA

Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware Vendor— Affected See references Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPE	Versions	Role	Vendor
cpe:2.3:o:intel:ethernet_controller_i225-it_firmware::::::::	before 1.87	Vulnerable	Intel
cpe:2.3:h:intel:ethernet_controller_i225-it:-:::::::*	not specified by NVD	Running on	Intel
cpe:2.3:o:intel:ethernet_controller_i225-lm_firmware::::::::	before 1.87	Vulnerable	Intel
cpe:2.3:h:intel:ethernet_controller_i225-lm:-:::::::*	not specified by NVD	Running on	Intel
cpe:2.3:o:intel:ethernet_controller_i225-v_firmware::::::::	before 1.87	Vulnerable	Intel
cpe:2.3:h:intel:ethernet_controller_i225-v:-:::::::*	not specified by NVD	Running on	Intel
cpe:2.3:a:intel:ethernet_adapter_complete_driver::::::::	before 29.0.1	Vulnerable	Intel

cpe:2.3:o:intel:ethernet_controller_i225-it_firmware:*:*:*:*:*:*:*:* Versions before 1.87 Vulnerable ·Intel
cpe:2.3:h:intel:ethernet_controller_i225-it:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
cpe:2.3:o:intel:ethernet_controller_i225-lm_firmware:*:*:*:*:*:*:*:* Versions before 1.87 Vulnerable ·Intel
cpe:2.3:h:intel:ethernet_controller_i225-lm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
cpe:2.3:o:intel:ethernet_controller_i225-v_firmware:*:*:*:*:*:*:*:* Versions before 1.87 Vulnerable ·Intel
cpe:2.3:h:intel:ethernet_controller_i225-v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
cpe:2.3:a:intel:ethernet_adapter_complete_driver:*:*:*:*:*:*:*:* Versions before 29.0.1 Vulnerable ·Intel

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-37341
2026-10-03 Alias added: GHSA-hh4g-rh5c-8w86

References

Advisory 1

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00756.html

TI-2021-12711 Improper input validation in Intel Ethernet Adapters and Intel Ethernet Controller I225… CVSS 3.1HIGH 8.6
TI-2021-12723 Improper access control in Intel Ethernet Adapters and Intel Ethernet Controller I225… CVSS 3.1HIGH 8.4
TI-2023-20568 Improper access control in Intel Ethernet tools and driver install software, CVSS 3.1HIGH 7.8
TI-2021-12722 Improper input validation in Intel Ethernet Adapters and Intel Ethernet Controller I225… CVSS 3.1HIGH 7.2
TI-2021-12713 Uncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller… CVSS 3.1HIGH 7.2
TI-2021-12720 Improper neutralization in some Intel(R) Ethernet Adapters and Intel(R) Ethernet… CVSS 3.1HIGH 7.2

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences