What’s Vulnerable › Vulnerabilities
CVE-2020-8745
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-11-12 · updated 2026-06-17
Description
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Affected products
- Intel Converged Security And Manageability Engine: before 11.8.80; from 11.12.0 before 11.12.80; from 11.22.0 before 11.22.80; from 12.0 before 12.0.70; from 14.0 before 14.0.45; from 14.5.0 before 14.5.25 — fixed in 11.12.80, 11.22.80, 11.8.80, 12.0.70, 14.0.45, 14.5.25
- Intel Trusted Execution Technology: before 3.1.80; from 4.0 before 4.0.30 — fixed in 3.1.80, 4.0.30
- Siemens Simatic Drive Controller Firmware: before 05.00.01.00 — fixed in 05.00.01.00
- Siemens Simatic Et200Sp 1515Sp Pc2 Firmware: before 0209.0105 — fixed in 0209.0105
- Siemens Simatic Field Pg M5 Firmware: before 22.01.08 — fixed in 22.01.08
- Siemens Simatic Field Pg M6 Firmware: all versions
- Siemens Simatic Ipc127E Firmware: before 27.01.05 — fixed in 27.01.05
- Siemens Simatic Ipc427E Firmware: before 27.01.05 — fixed in 27.01.05
- Siemens Simatic Ipc477E Firmware: before 21.01.15 — fixed in 21.01.15
- Siemens Simatic Ipc527G Firmware: before 1.4.0 — fixed in 1.4.0
- Siemens Simatic Ipc547G Firmware: before r1.30.0 — fixed in r1.30.0
- Siemens Simatic Ipc627E Firmware: before 25.02.08 — fixed in 25.02.08
- Siemens Simatic Ipc647E Firmware: before 25.02.08 — fixed in 25.02.08
- Siemens Simatic Ipc667E Firmware: before 25.02.08 — fixed in 25.02.08
- Siemens Simatic Ipc847E Firmware: before 25.02.08 — fixed in 25.02.08
- Siemens Simatic Itp1000 Firmware: before 23.01.08 — fixed in 23.01.08
- Siemens Sinumerik 828D Hw Pu.4 Firmware: before 08.00.00.00 — fixed in 08.00.00.00
- Siemens Sinumerik 840D Sl Ht 10 Firmware: all versions
- Siemens Sinumerik Mc Mcu 1720 Firmware: before 05.00.00.00 — fixed in 05.00.00.00
- Siemens Sinumerik One Firmware: all versions
- Siemens Sinumerik One Ncu 1740 Firmware: before 04.00.00.00 — fixed in 04.00.00.00
- Siemens Sinumerik One Ppu 1740 Firmware: before 06.00.00.00 — fixed in 06.00.00.00
How to fix
Upgrade to a fixed version: Intel Converged Security And Manageability Engine 11.12.80, 11.22.80, 11.8.80, 12.0.70; Intel Trusted Execution Technology 3.1.80, 4.0.30; Siemens Simatic Drive Controller Firmware 05.00.01.00; Siemens Simatic Et200Sp 1515Sp Pc2 Firmware 0209.0105; Siemens Simatic Field Pg M5 Firmware 22.01.08; Siemens Simatic Ipc127E Firmware 27.01.05; Siemens Simatic Ipc427E Firmware 27.01.05; Siemens Simatic Ipc477E Firmware 21.01.15; Siemens Simatic Ipc527G Firmware 1.4.0; Siemens Simatic Ipc547G Firmware r1.30.0; Siemens Simatic Ipc627E Firmware 25.02.08; Siemens Simatic Ipc647E Firmware 25.02.08. Check the vendor advisory for mitigations.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf
- https://security.netapp.com/advisory/ntap-20201113-0002/
- https://security.netapp.com/advisory/ntap-20201113-0005/
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391
- https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf
- https://security.netapp.com/advisory/ntap-20201113-0002/
- https://security.netapp.com/advisory/ntap-20201113-0005/
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391
Get alerted when CVE-2020-8745 or the next vulnerability affects your stack