Server Platform Services Firmware
Vendor:
First CVE: Nov 21, 2017 · Active for 8 years
15
Total CVEs
More Total CVEs than 92% of tracked products
3.8
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
6.5
Avg CVSS
Higher Avg CVSS than 32% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Server Platform Services Firmware over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 21, 2017
8 years ago
Most Recent CVE
Nov 11, 2022
1,351 days ago
CVE Severity & Scoring
Server Platform Services Firmware15 CVEs
60%
40%
All CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local9 (60.0%)
Network1 (6.7%)
Unknown0 (0.0%)
Physical5 (33.3%)
Adjacent Network0 (0.0%)
Attack Complexity
Low14 (93.3%)
High1 (6.7%)
Unknown0 (0.0%)
User Interaction
None15 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low4 (26.7%)
High5 (33.3%)
None6 (40.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-3655HIGH A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Execution Engine Firmware before version 3 | Sep 12, 2018 | 7.3 | 26 | NO | NO |
CVE-2018-3643HIGH A vulnerability in Power Management Controller firmware in systems using specific Intel(R) Converged Security and Management Engine (CSME) before version 11.8.55, 11.11.55, 11.21.5 | Sep 12, 2018 | 8.2 | 26 | NO | NO |
CVE-2017-5709HIGH Multiple privilege escalations in kernel in Intel Server Platform Services Firmware 4.0 allows unauthorized process to access privileged content via unspecified vector. | Nov 21, 2017 | 7.8 | 25 | NO | NO |
CVE-2017-5706HIGH Multiple buffer overflows in kernel in Intel Server Platform Services Firmware 4.0 allow attacker with local access to the system to execute arbitrary code. | Nov 21, 2017 | 7.8 | 25 | NO | NO |
CVE-2018-12208HIGH Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel(R) TXE version before 3.1.60 or 4.0.10, or Intel(R) Server Platf | Mar 14, 2019 | 7.6 | 24 | NO | NO |
CVE-2018-12191HIGH Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before versions 4.00.04.383 or SPS 4.01.0 | Mar 14, 2019 | 7.6 | 24 | NO | NO |
CVE-2018-12147MEDIUM Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Fir | Jun 13, 2019 | 6.7 | 23 | NO | NO |
CVE-2018-12192MEDIUM Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_04.00.04.393.0 may all | Mar 14, 2019 | 6.8 | 23 | NO | NO |
CVE-2019-11090MEDIUM Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70 and 4.0.20; Intel(R) | Dec 18, 2019 | 5.9 | 22 | NO | NO |
CVE-2019-0099MEDIUM Insufficient access control vulnerability in subsystem in Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of pr | May 17, 2019 | 6.8 | 22 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (15 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (15 CVEs).
Media Mentions
Signals from CVEs in this product scope (15 CVEs).
Top CNAs Publishing CVEs For Server Platform Services Firmware
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.0 | 2 | 7.8 | 0.6% | 0 | 0 |