cvelistv5 - cve-2025-20096

CVE-2025-20096 (GCVE-0-2025-20096)

Vulnerability from cvelistv5

Published

2026-03-10 22:31

Modified

2026-03-12 03:55

Severity ?

5.9 (Medium) - CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

CWE

Escalation of Privilege
CWE-20 - Improper Input Validation

Summary

Improper input validation in the UEFI firmware for some Intel Reference Platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.

References

URL

Tags

https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01393.html

Impacted products

	Vendor	Product	Version
	n/a	Intel Reference Platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.	Version: See references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20096",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-12T03:55:42.117Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Intel Reference Platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "See references"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper input validation in the UEFI firmware for some Intel Reference Platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege",
              "lang": "en"
            },
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-10T22:31:19.925Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01393.html",
          "url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01393.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2025-20096",
    "datePublished": "2026-03-10T22:31:19.925Z",
    "dateReserved": "2025-04-15T21:11:09.773Z",
    "dateUpdated": "2026-03-12T03:55:42.117Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20096\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-11T13:53:55.642616Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-11T13:53:58.488Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.9, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"n/a\", \"product\": \"Intel Reference Platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.\", \"versions\": [{\"status\": \"affected\", \"version\": \"See references\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01393.html\", \"name\": \"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01393.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper input validation in the UEFI firmware for some Intel Reference Platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"Escalation of Privilege\"}, {\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"6dda929c-bb53-4a77-a76d-48e79601a1ce\", \"shortName\": \"intel\", \"dateUpdated\": \"2026-03-10T22:31:19.925Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-20096\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-12T03:55:42.117Z\", \"dateReserved\": \"2025-04-15T21:11:09.773Z\", \"assignerOrgId\": \"6dda929c-bb53-4a77-a76d-48e79601a1ce\", \"datePublished\": \"2026-03-10T22:31:19.925Z\", \"assignerShortName\": \"intel\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0261

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Intel. Elles permettent à un attaquant de provoquer une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Intel	les processeurs Intel	Intel Xeon D processor Family
Intel	les processeurs Intel	Intel Core X-series Processors
Intel	les processeurs Intel	8th Generation Intel Core Processor Family
Intel	les processeurs Intel	Intel Atom Processor X Series
Intel	les processeurs Intel	Intel Xeon W processor 2200 series
Intel	les processeurs Intel	Intel Xeon Scalable processor family
Intel	les processeurs Intel	Intel Atom Processors
Intel	les processeurs Intel	Intel Xeon 6
Intel	les processeurs Intel	Intel Atom C5000 and P5000 Product Family
Intel	les processeurs Intel	10th Generation Intel Core Processor Family
Intel	les processeurs Intel	Intel Xeon W processor 2100 series Intel Core X-series processor
Intel	les processeurs Intel	Intel Xeon Processor E7 v3 Family
Intel	les processeurs Intel	Intel Core Ultra Processors Series 1
Intel	les processeurs Intel	3rd Generation Intel Xeon Scalable Processor Family
Intel	les processeurs Intel	7th Generation Intel Core Processor Family
Intel	les processeurs Intel	Intel Atom C processor Family
Intel	les processeurs Intel	9th Generation Intel Core Processor Family
Intel	les processeurs Intel	Intel Xeon Processor D NS Family
Intel	les processeurs Intel	5th Generation Intel Xeon Scalable Processors
Intel	les processeurs Intel	Intel Core Ultra Processors Series 2
Intel	les processeurs Intel	13th Generation Intel Core Processors
Intel	les processeurs Intel	12th Generation Intel Core Processors
Intel	les processeurs Intel	Intel Xeon E processor family
Intel	les processeurs Intel	Intel Xeon Processor E5 v4 Family
Intel	les processeurs Intel	Intel Atom Processors P6000
Intel	les processeurs Intel	2nd Generation Intel Xeon Scalable Processors
Intel	les processeurs Intel	1st Generation Intel Xeon Scalable processor
Intel	les processeurs Intel	11th Generation Intel Core Processors
Intel	les processeurs Intel	4th Generation Intel Xeon Scalable processors
Intel	les processeurs Intel	Intel Xeon W Processor Family
Intel	les processeurs Intel	Intel Xeon W processor 3100 series

References

Title

Publication Time

Tags

Bulletin de sécurité Intel intel-sa-01234	2026-03-10	vendor-advisory
Bulletin de sécurité Intel intel-sa-01393	2026-03-10	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Intel Xeon D processor Family",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Core X-series Processors",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "8th Generation Intel Core Processor Family",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Atom Processor X Series",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Xeon W processor 2200 series",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Xeon Scalable processor family",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Atom Processors",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Xeon 6",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Atom C5000 and P5000 Product Family",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "10th Generation Intel Core Processor Family",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Xeon W processor 2100 series\n\nIntel Core X-series processor",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Xeon Processor E7 v3 Family",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Core Ultra Processors Series 1",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "3rd Generation Intel Xeon Scalable Processor Family",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "7th Generation Intel Core Processor Family",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Atom C processor Family",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "9th Generation Intel Core Processor Family ",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Xeon Processor D NS Family",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "5th Generation Intel  Xeon Scalable Processors",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Core Ultra Processors Series 2",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "13th Generation Intel Core Processors\n\n",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "12th Generation Intel Core Processors",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Xeon E processor family ",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Xeon Processor E5 v4 Family ",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Atom Processors P6000",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "2nd Generation Intel Xeon Scalable Processors",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "1st Generation Intel Xeon Scalable processor",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "11th Generation Intel Core Processors",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "4th Generation Intel Xeon Scalable processors",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Xeon W Processor Family",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Xeon W processor 3100 series",
      "product": {
        "name": "les processeurs Intel",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-20068",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20068"
    },
    {
      "name": "CVE-2025-22850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22850"
    },
    {
      "name": "CVE-2025-20005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20005"
    },
    {
      "name": "CVE-2025-20027",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20027"
    },
    {
      "name": "CVE-2025-22444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22444"
    },
    {
      "name": "CVE-2025-20105",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20105"
    },
    {
      "name": "CVE-2025-20073",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20073"
    },
    {
      "name": "CVE-2025-20096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20096"
    },
    {
      "name": "CVE-2025-20028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20028"
    },
    {
      "name": "CVE-2025-20064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-20064"
    }
  ],
  "initial_release_date": "2026-03-11T00:00:00",
  "last_revision_date": "2026-03-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0261",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-03-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Intel. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Intel",
  "vendor_advisories": [
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-01234",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01234.html"
    },
    {
      "published_at": "2026-03-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-01393",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01393.html"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2025-20096 (GCVE-0-2025-20096)

Vulnerability from cvelistv5

CERTFR-2026-AVI-0261

Vulnerability from certfr_avis

Solutions

Tags

Sightings

Nomenclature