Intel EMA EUVD-2025-209792

Exploitation requires adjacent-network access (CVSS AV:A): the attacker must be positioned on the same logical or physical network segment as an Intel EMA host running a version before 1.14.5 - it is not exploitable from an arbitrary internet location. Within that positioning, no further prerequisites apply: no authentication (PR:N), no user interaction (UI:N), no special attack requirements (AT:N), and low complexity (AC:L), and Intel notes exploitation is possible 'when attack requirements are not present without special internal knowledge.' The primary limiting factors are therefore the network-adjacency requirement and the affected-version boundary (only builds prior to 1.14.5); hosts on isolated/segmented management networks are substantially harder to reach.

The signals are mixed and lean toward moderate real-world priority despite the High 8.7 score. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) indicates a low-complexity, unauthenticated attack needing no user interaction, and vulnerable-system impact is total (VC:H/VI:H/VA:H) - matching SSVC 'Technical Impact: total.' However, the AV:A adjacent-network requirement meaningfully constrains reach: an attacker must already be on the same logical/physical network segment as the EMA host, not the open internet. Corroborating this, SSVC reports Exploitation: none and Automatable: no, EPSS is 0.03% (9th percentile), the vulnerability is not in CISA KEV, and no POC is known. In short, high technical impact but low exploitation likelihood and a gated attack surface - patch on a normal prioritized cycle rather than as an emergency, giving priority to EMA hosts reachable from lower-trust network zones.

An attacker who has gained a foothold on the same network segment as an Intel EMA host - for example a compromised workstation or a rogue device on the management VLAN - sends crafted, malformed input to the EMA user-application component. Because input is improperly validated and no authentication or user interaction is required, the flaw is triggered to escalate the attacker's privileges on the EMA system, yielding full control of its data and operation. No public exploit code is identified at time of analysis, so this remains a plausible but not currently demonstrated attack.