#VU50602 Use of hard-coded cryptographic key in Intel products - CVE-2020-12376

Vulnerability identifier: #VU50602

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2020-12376

CWE-ID: CWE-321

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
Intel Server System R1000WF
Intel Server System R2000WF
Intel Server Board S2600WF
Intel Server Board S2600ST
Intel Compute Module HNS2600BP
Intel Server Board S2600BP

Software vendor:
Intel

The vulnerability allows a local user gain access to sensitive information.

The vulnerability exists due to usage of a hard-coded key in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47.A local user can gain access to sensitive information on the system.

Install updates from vendor's website.

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00434.html