CVE-2020-24516

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-09 · updated 2026-06-17

Description

Modification of assumed-immutable data in subsystem in Intel(R) CSME versions before 13.0.47, 13.30.17, 14.1.53, 14.5.32, 15.0.22 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

Affected products

Intel Converged Security And Manageability Engine: before 13.0.47; before 13.30.17; before 14.1.53; before 14.5.32; before 15.0.22 — fixed in 13.0.47, 13.30.17, 14.1.53, 14.5.32, 15.0.22

How to fix

Upgrade to a fixed version: Intel Converged Security And Manageability Engine 13.0.47, 13.30.17, 14.1.53, 14.5.32. Check the vendor advisory for mitigations.

References

https://security.netapp.com/advisory/ntap-20210625-0008/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html
https://security.netapp.com/advisory/ntap-20210625-0008/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html

Get alerted when CVE-2020-24516 or the next vulnerability affects your stack