Read the docs
TI-2023-17257 Aliases CVE-2023-34431GHSA-gqwc-m2xc-gx3c

Improper input validation in Intel Server Board BIOS firmware

Priority LOW 37CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Improper input validation in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0024 15th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Intel(R) Server Board BIOS firmwareSee references—No fix listedCNA
  • Intel(R) Server Board BIOS firmware Vendor— Affected See references Fixed in — No fix listed CNA

CPE configurations NVD · 66

CPEVersionsRoleVendor
cpe:2.3:o:intel:server_board_m70klp2sb_firmware:*:*:*:*:*:*:*:*before 01.04.0022VulnerableIntel
cpe:2.3:h:intel:server_board_m70klp2sb:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_system_m70klp4s2uhh_firmware:*:*:*:*:*:*:*:*before 01.04.0022VulnerableIntel
cpe:2.3:h:intel:server_system_m70klp4s2uhh:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_board_m20ntp2sb_firmware:*:*:*:*:*:*:*:*before 0022.d02VulnerableIntel
cpe:2.3:h:intel:server_board_m20ntp2sb:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_system_m20ntp1ur304_firmware:*:*:*:*:*:*:*:*before 0022.d02VulnerableIntel
cpe:2.3:h:intel:server_system_m20ntp1ur304:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_board_m10jnp2sb_firmware:*:*:*:*:*:*:*:*before 7.219VulnerableIntel
cpe:2.3:h:intel:server_board_m10jnp2sb:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
  • cpe:2.3:o:intel:server_board_m70klp2sb_firmware:*:*:*:*:*:*:*:* Versions before 01.04.0022 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_board_m70klp2sb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_system_m70klp4s2uhh_firmware:*:*:*:*:*:*:*:* Versions before 01.04.0022 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_system_m70klp4s2uhh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_board_m20ntp2sb_firmware:*:*:*:*:*:*:*:* Versions before 0022.d02 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_board_m20ntp2sb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_system_m20ntp1ur304_firmware:*:*:*:*:*:*:*:* Versions before 0022.d02 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_system_m20ntp1ur304:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_board_m10jnp2sb_firmware:*:*:*:*:*:*:*:* Versions before 7.219 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_board_m10jnp2sb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
Show 56 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:intel:server_board_s2600bpbr_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_board_s2600bpbr:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_board_s2600bps_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_board_s2600bps:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_board_s2600bpsr_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_board_s2600bpsr:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_board_s2600bpqr_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_board_s2600bpqr:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_board_s2600bpb_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_board_s2600bpb:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_board_s2600bpq_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_board_s2600bpq:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpblcr_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpblcr:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpblc_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpblc:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpblc24r_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpblc24r:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bps_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bps:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bps24_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bps24:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpbr_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpbr:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpqr_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpqr:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpsr_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpsr:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bps24r_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bps24r:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpq24r_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpq24r:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpb24_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpb24:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpb_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpb:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpblc24_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpblc24:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpq_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpq:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_hns2600bpq24_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_hns2600bpq24:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:compute_module_liquid-cooled_hns2600bpbrct_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:compute_module_liquid-cooled_hns2600bpbrct:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_system_vrn2224bpaf6_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_system_vrn2224bpaf6:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_system_vrn2224bphy6_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_system_vrn2224bphy6:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_system_mcb2208wfaf5_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_system_mcb2208wfaf5:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_system_zsb2224bpaf2_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_system_zsb2224bpaf2:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_system_zsb2224bphy1_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_system_zsb2224bphy1:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:server_system_zsb2224bpaf1_firmware:*:*:*:*:*:*:*:*before 02.01.0015VulnerableIntel
cpe:2.3:h:intel:server_system_zsb2224bpaf1:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
  • cpe:2.3:o:intel:server_board_s2600bpbr_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_board_s2600bpbr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_board_s2600bps_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_board_s2600bps:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_board_s2600bpsr_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_board_s2600bpsr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_board_s2600bpqr_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_board_s2600bpqr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_board_s2600bpb_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_board_s2600bpb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_board_s2600bpq_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_board_s2600bpq:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpblcr_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpblcr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpblc_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpblc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpblc24r_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpblc24r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bps_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bps:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bps24_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bps24:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpbr_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpbr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpqr_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpqr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpsr_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpsr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bps24r_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bps24r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpq24r_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpq24r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpb24_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpb24:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpb_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpblc24_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpblc24:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpq_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpq:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_hns2600bpq24_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_hns2600bpq24:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:compute_module_liquid-cooled_hns2600bpbrct_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:compute_module_liquid-cooled_hns2600bpbrct:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_system_vrn2224bpaf6_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_system_vrn2224bpaf6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_system_vrn2224bphy6_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_system_vrn2224bphy6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_system_mcb2208wfaf5_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_system_mcb2208wfaf5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_system_zsb2224bpaf2_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_system_zsb2224bpaf2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_system_zsb2224bphy1_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_system_zsb2224bphy1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:server_system_zsb2224bpaf1_firmware:*:*:*:*:*:*:*:* Versions before 02.01.0015 Vulnerable ·Intel
  • cpe:2.3:h:intel:server_system_zsb2224bpaf1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-34431
  2. 2026-10-03 Alias added: GHSA-gqwc-m2xc-gx3c

References

Patch 1

  • TI-2022-14948 Improper input validation in Intel Server board and Intel Server System BIOS firmware CVSS 3.1HIGH 8.2
  • TI-2022-11800 Improper buffer restrictions in some Intel(R) Server Board BIOS firmware may allow a… CVSS 3.1HIGH 7.9
  • TI-2022-11970 Memory corruption in Intel Server Board M10JNP2SB BIOS firmware CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences