CVE-2023-28738

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-28738
Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalation of privilege via local access.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01009.html Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:intel:nuc_7_essential_nuc7cjysamn_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_7_essential_nuc7cjysamn:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:intel:nuc_kit_nuc7cjyhn_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_kit_nuc7cjyhn:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:intel:nuc_kit_nuc7pjyhn_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_kit_nuc7pjyhn:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:intel:nuc_kit_nuc7pjyh_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_kit_nuc7pjyh:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:intel:nuc_kit_nuc7cjysal_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_kit_nuc7cjysal:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:intel:nuc_kit_nuc7cjyh_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_kit_nuc7cjyh:-:*:*:*:*:*:*:*
History

30 Jan 2024, 15:18

Type Values Removed Values Added
First Time Intel nuc 7 Essential Nuc7cjysamn Firmware
Intel nuc Kit Nuc7cjyh
Intel nuc Kit Nuc7pjyh Firmware
Intel nuc Kit Nuc7cjyh Firmware
Intel nuc Kit Nuc7cjyhn
Intel nuc 7 Essential Nuc7cjysamn
Intel nuc Kit Nuc7pjyh
Intel nuc Kit Nuc7pjyhn Firmware
Intel nuc Kit Nuc7cjyhn Firmware
Intel
Intel nuc Kit Nuc7cjysal Firmware
Intel nuc Kit Nuc7pjyhn
Intel nuc Kit Nuc7cjysal
References () https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01009.html - () https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01009.html - Vendor Advisory
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:intel:nuc_kit_nuc7pjyh_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:o:intel:nuc_kit_nuc7cjyh_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:o:intel:nuc_kit_nuc7cjyhn_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:o:intel:nuc_kit_nuc7cjysal_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_7_essential_nuc7cjysamn:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:nuc_7_essential_nuc7cjysamn_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_kit_nuc7pjyh:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_kit_nuc7cjyh:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_kit_nuc7cjysal:-:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_kit_nuc7cjyhn:-:*:*:*:*:*:*:*
cpe:2.3:o:intel:nuc_kit_nuc7pjyhn_firmware:jyglkcpx.0071:*:*:*:*:*:*:*
cpe:2.3:h:intel:nuc_kit_nuc7pjyhn:-:*:*:*:*:*:*:*
Summary
  • (es) La validación de entrada incorrecta para algunos firmware de BIOS Intel NUC anteriores a la versión JY0070 puede permitir que un usuario privilegiado habilite potencialmente la escalada de privilegios a través del acceso local.

19 Jan 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-19 20:15

Updated : 2024-01-30 15:18

NVD link : CVE-2023-28738

Mitre link : CVE-2023-28738

CVE.ORG link : CVE-2023-28738

JSON object : View

Products Affected

intel

  • nuc_kit_nuc7cjyhn
  • nuc_7_essential_nuc7cjysamn_firmware
  • nuc_kit_nuc7cjyh_firmware
  • nuc_kit_nuc7pjyhn_firmware
  • nuc_kit_nuc7pjyh_firmware
  • nuc_kit_nuc7pjyh
  • nuc_kit_nuc7cjyhn_firmware
  • nuc_kit_nuc7cjysal_firmware
  • nuc_kit_nuc7cjyh
  • nuc_7_essential_nuc7cjysamn
  • nuc_kit_nuc7pjyhn
  • nuc_kit_nuc7cjysal
CWE
CWE-20

Improper Input Validation