Intel Server FUU CVE-2025-35969

Exploitation requires: (1) local authenticated access with at least low-privilege credentials (PR:L per CVSS 4.0); (2) write access to at least one directory within the uncontrolled search path that the utility consults before trusted system paths - typically a user-writable location in PATH or the working directory at launch time; (3) a specific attack precondition must be present (AT:P), such as the utility being configured to execute from a writable or shared directory context; and (4) active user interaction - a legitimate user or process must launch the utility after the malicious file has been staged (UI:A). What limits exploitation: remote exploitation is categorically excluded (AV:L); unauthenticated access is insufficient; the attack complexity is high (AC:H), requiring precise file naming and path positioning; and exploitation is not automatable per SSVC assessment.

Real-world risk is moderate despite the theoretical high C/I/A impact. The CVSS 4.0 score of 5.4 (Medium) reflects multiple mitigating factors: local-only attack vector (AV:L), high attack complexity (AC:H), a specific attack requirement that must be present (AT:P), low-privilege authentication required (PR:L), and mandatory active user interaction (UI:A). EPSS at 0.01% (3rd percentile) and SSVC exploitation status of 'none' confirm no known weaponization. There is no CISA KEV listing. SSVC technical impact is rated 'total,' meaning successful exploitation fully compromises the local system - but the multi-condition chain (authenticated local access + plant malicious file + trigger user execution) materially limits attacker opportunity. The primary risk population is shared or multi-tenant server environments where low-privileged users can write to directories within the utility's search path. This is not a remotely exploitable, spray-and-pray class of vulnerability.

A low-privileged authenticated attacker on a shared Intel server management host places a malicious DLL or executable - named to match a library the utility loads - in a directory the operating system searches before the trusted installation path (e.g., the current working directory or a user-writable PATH entry). When an administrator or elevated process subsequently launches the Intel Server Firmware Update Utility (satisfying the active user interaction requirement), the application resolves and loads the attacker's library, executing arbitrary code at the elevated privilege level of the launching process. No public proof-of-concept is known, but the technique is well-understood for CWE-427 class flaws.