CVE-2023-32655 - OpenCVE

Path transversal in some Intel(R) NUC Kits & Mini PCs - NUC8i7HVK & NUC8HNK USB Type C power delivery controller installatio software before version 1.0.10.3 for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Intel	Nuc Kit Nuc8i7hvk Usb Type C Power Delivery Controller Nuc 8 Enthusiast Nuc8i7hvkva Nuc 8 Enthusiast Nuc8i7hvkvaw Nuc Kit Nuc8i7hnk Nuc 8 Business Nuc8i7hnkqc

Configuration 1 [-]

AND

cpe:2.3:a:intel:usb_type_c_power_delivery_controller:*:*:*:*:*:windows:*:*

OR	cpe:2.3:h:intel:nuc_8_business_nuc8i7hnkqc:-:::::::*
	cpe:2.3:h:intel:nuc_8_enthusiast_nuc8i7hvkva:-:::::::*
	cpe:2.3:h:intel:nuc_8_enthusiast_nuc8i7hvkvaw:-:::::::*
	cpe:2.3:h:intel:nuc_kit_nuc8i7hnk:-:::::::*
	cpe:2.3:h:intel:nuc_kit_nuc8i7hvk:-:::::::*

References

Link	Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html	Patch Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: intel

Published: 2023-11-14T19:04:50.082Z

Updated: 2023-11-14T19:04:50.082Z

Reserved: 2023-06-02T03:00:03.779Z

Link: CVE-2023-32655

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-11-14T19:15:26.230

Modified: 2023-11-20T20:58:37.973

Link: CVE-2023-32655

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:intel:usb_type_c_power_delivery_controller:*:*:*:*:*:windows:*:*", "matchCriteriaId": "0B21EFAA-D473-44AE-9930-0A4256FF7DE7", "versionEndExcluding": "1.0.10.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:intel:nuc_8_business_nuc8i7hnkqc:-:*:*:*:*:*:*:*", "matchCriteriaId": "6041D0C6-BAA8-410B-9AE7-F2E164F04A6C", "vulnerable": false}, {"criteria": "cpe:2.3:h:intel:nuc_8_enthusiast_nuc8i7hvkva:-:*:*:*:*:*:*:*", "matchCriteriaId": "F2C17AD1-F813-484D-AC73-4A9BBCE233BB", "vulnerable": false}, {"criteria": "cpe:2.3:h:intel:nuc_8_enthusiast_nuc8i7hvkvaw:-:*:*:*:*:*:*:*", "matchCriteriaId": "C95A2886-F2CC-45A3-8877-AE894FF86898", "vulnerable": false}, {"criteria": "cpe:2.3:h:intel:nuc_kit_nuc8i7hnk:-:*:*:*:*:*:*:*", "matchCriteriaId": "244CD6EC-780A-405E-8CFA-666A666FF7D5", "vulnerable": false}, {"criteria": "cpe:2.3:h:intel:nuc_kit_nuc8i7hvk:-:*:*:*:*:*:*:*", "matchCriteriaId": "1D391590-652D-4B98-89F1-9F31F479448B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Path transversal in some Intel(R) NUC Kits & Mini PCs - NUC8i7HVK & NUC8HNK USB Type C power delivery controller installatio software before version 1.0.10.3 for Windows may allow an authenticated user to potentially enable escalation of privilege via local access."}, {"lang": "es", "value": "Path Transversal en algunos software de instalaci\u00f3n del controlador Intel(R) NUC Kits & Mini PCs - NUC8i7HVK & NUC8HNK USB Type C de suministro de energ\u00eda antes de la versi\u00f3n 1.0.10.3 para Windows puede permitir que un usuario autenticado habilite potencialmente la escalada de privilegios a trav\u00e9s del acceso local."}], "id": "CVE-2023-32655", "lastModified": "2023-11-20T20:58:37.973", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "secure@intel.com", "type": "Secondary"}]}, "published": "2023-11-14T19:15:26.230", "references": [{"source": "secure@intel.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html"}], "sourceIdentifier": "secure@intel.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-249"}], "source": "secure@intel.com", "type": "Secondary"}]}