CVEvulnerability

CVE-2017-5689

9.8 CRITICAL Known exploited Published 2017-05-02 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability — Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability

Intel products contain a vulnerability which can allow attackers to perform privilege escalation.

Added to KEV: 2022-01-28
Remediation due: 2022-07-28
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-5689

Status: Analyzed
Published: 2017-05-02
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses: CWE-269

Description

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

Affected configurations

• hpe proliant ml10 gen9 server firmware 5.0 • siemens simatic itp1000 firmware (< 9.1.41.3024) • siemens simatic ipc847d firmware (< 9.1.41.3024) • siemens simatic ipc847c firmware (< 6.2.61.3535) • siemens simatic ipc827d firmware (< 9.1.41.3024) • siemens simatic ipc827c firmware (< 6.2.61.3535) • siemens simatic ipc677d firmware (< 9.1.41.3024) • siemens simatic ipc677c firmware (< 6.2.61.3535) • siemens simatic ipc647d firmware (< 9.1.41.3024) • siemens simatic ipc647c firmware (< 6.2.61.3535) • siemens simatic ipc627d firmware (< 9.1.41.3024) • siemens simatic ipc627c firmware (< 6.2.61.3535) • siemens simatic ipc547g firmware (< 11.0.26.3000) • siemens simatic ipc547e firmware (< 9.1.41.3024) • siemens simatic ipc547d firmware (< 7.1.91.3272) • siemens simatic ipc477e firmware (< 21.01.05) • siemens simatic ipc477d firmware • siemens simatic field pg m3 firmware (< 6.2.61.3535) • siemens simatic field pg m4 firmware (< 18.01.06) • siemens simatic field pg m5 firmware (< 22.01.03) • siemens simatic pcs 7 ipc427e firmware (< 21.01.04) • siemens simatic pcs 7 ipc547d firmware (< 7.1.91.3272) • siemens simatic pcs 7 ipc547e firmware (< 9.1.41.3024) • siemens simatic pcs 7 ipc547g firmware (< 11.0.26.3000) • siemens simatic pcs 7 ipc627c firmware (< 6.2.61.3535) • siemens simatic pcs 7 ipc677c firmware (< 6.2.61.3535) • siemens simatic pcs 7 ipc647c firmware (< 6.2.61.3535) • siemens simatic pcs 7 ipc647d firmware (< 9.1.41.3024) • siemens simatic pcs 7 ipc847c firmware (< 6.2.61.3535) • siemens simatic pcs 7 ipc847d firmware (< 9.1.41.3024) • siemens simatic pcs 7 ipc427e firmware • siemens simatic pcs 7 ipc477d firmware • siemens simatic ipc427d firmware • siemens simatic ipc427e firmware (< 21.01.05) • siemens simotion p320-4 s firmware (< 17.02.06.83.1) • siemens sinumerik pcu50.5-p firmware (< 6.2.61.3535) • intel active management technology firmware 6.0 • intel active management technology firmware 6.1 • intel active management technology firmware 6.2 • intel active management technology firmware 7.0 • intel active management technology firmware 7.1 • intel active management technology firmware 8.0 • intel active management technology firmware 8.1 • intel active management technology firmware 9.0 • intel active management technology firmware 9.1 • intel active management technology firmware 9.5 • intel active management technology firmware 10.0 • intel active management technology firmware 11.0 • intel active management technology firmware 11.5 • intel active management technology firmware 11.6

Weakness · CWE (1)

CWE-269 Improper Privilege Management weakness

References

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch, Third Party Advisory
http://www.securityfocus.com/bid/98269 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038385 Broken Link, Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf Third Party Advisory
https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf Broken Link
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us Third Party Advisory
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20170509-0001/ Third Party Advisory
https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf Broken Link, Exploit, Technical Description, Third Party Advisory
https://www.embedi.com/news/mythbusters-cve-2017-5689 Broken Link, Third Party Advisory
https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability Technical Description, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch, Third Party Advisory
http://www.securityfocus.com/bid/98269 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038385 Broken Link, Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf Third Party Advisory
https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf Broken Link
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us Third Party Advisory
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20170509-0001/ Third Party Advisory
https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf Broken Link, Exploit, Technical Description, Third Party Advisory
https://www.embedi.com/news/mythbusters-cve-2017-5689 Broken Link, Third Party Advisory
https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability Technical Description, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5689 US Government Resource