Nuc 8 Mainstream Game Kit Firmware
CVE-2019-14611
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS score of 6.7 (MEDIUM). Attack characteristics: local attack vector, low complexity, high privileges required, no user interaction not required. |
| Exploit ScenarioDerived | A local attacker with access to the system could cause unexpected behavior through arithmetic overflow. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Validate arithmetic operations, use safe integer libraries, check bounds before allocation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as Integer Overflow (CWE-190), which allows attackers to cause unexpected behavior through arithmetic overflow. Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access. Affected products include: Intel Nuc 8 Mainstream Game Kit Firmware, Intel Nuc 8 Mainstream Game Mini Computer Firmware, Intel Nuc8I7Bek Firmware, Intel Cd1P64Gk Firmware, Intel Nuc8I3Cysm Firmware.
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionNVD
Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Affected Products (CPE)NVD
Improper access control in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation
Improper buffer restrictions in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escal
Memory corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of pr
Pointer corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of p
Out of bounds write in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of priv
Improper input validation in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation o
GitHub PoC
Exploit-DB