CVE-2019-0086

HIGH

Intel Converged Security Management E... - Symlink Following

Title source: rule
STIX 2.1

Description

Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_confirm
https://support.f5.com/csp/article/K35815741
Various Sources x_refsource_misc
https://danishcyberdefence.dk/blog/dal

Scores

CVSS v3 7.8
EPSS 0.0004
EPSS Percentile 13.5%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-732 CWE-59
Status published
Products (2)
intel/converged_security_management_engine_firmware 11.0 - 11.8.65
intel/trusted_execution_engine_firmware 3.0 - 3.1.65
Published May 17, 2019
Tracked Since Feb 18, 2026