Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-3682

BMC Firmware in Intel server boards, compute modules, and systems potentially allow an attacker with administrative privileges to make unauthorized read\writes to the SMBUS.

Security Impact Summary

This vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 8.2, requiring local system access to exploit with relatively low complexity without requiring user interaction . The vulnerability impacts confidentiality (data exposure), integrity (unauthorized modifications), and availability (service disruption) for affected systems. Impacting 70 products from intel, from intel, from intel and 67 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

First disclosed in 2018, this vulnerability was reported during a period defined by widespread IoT adoption challenges, mobile security concerns, and the emergence of advanced persistent threat (APT) techniques. Contemporary mitigation strategies focused on secure development practices and third-party component vetting.

Published

2018-07-10T21:29:01.107

Last Modified

2024-11-21T04:05:53.010

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.2 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

3.9

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-269
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System intel bmc_firmware - Yes
Hardware intel bbs2600bpb - No
Hardware intel bbs2600bpq - No
Hardware intel bbs2600bps - No
Hardware intel bbs2600stb - No
Hardware intel bbs2600stq - No
Hardware intel bbs7200ap - No
Hardware intel bbs7200apl - No
Hardware intel dbs2600cw2r - No
Hardware intel dbs2600cw2sr - No
Hardware intel dbs2600cwtr - No
Hardware intel dbs2600cwtsr - No
Hardware intel hns2600bpb - No
Hardware intel hns2600bpb24 - No
Hardware intel hns2600bpblc - No
Hardware intel hns2600bpblc24 - No
Hardware intel hns2600bpq - No
Hardware intel hns2600bpq24 - No
Hardware intel hns2600bps - No
Hardware intel hns2600bps24 - No
Hardware intel hns2600kpfr - No
Hardware intel hns2600kpr - No
Hardware intel hns2600tp24r - No
Hardware intel hns2600tp24sr - No
Hardware intel hns2600tp24str - No
Hardware intel hns2600tpfr - No
Hardware intel hns2600tpnr - No
Hardware intel hns2600tpr - No
Hardware intel hns7200ap - No
Hardware intel hns7200apl - No
Hardware intel hns7200apr - No
Hardware intel hns7200aprl - No
Hardware intel r1208wftys - No
Hardware intel r1208wt2gsr - No
Hardware intel r1208wttgsr - No
Hardware intel r1304wf0ys - No
Hardware intel r1304wftys - No
Hardware intel r1304wt2gsr - No
Hardware intel r1304wttgsr - No
Hardware intel r2208wf0zs - No
Hardware intel r2208wfqzs - No
Hardware intel r2208wftzs - No
Hardware intel r2208wt2ysr - No
Hardware intel r2208wttyc1r - No
Hardware intel r2208wttysr - No
Hardware intel r2224wfqzs - No
Hardware intel r2224wftzs - No
Hardware intel r2224wttysr - No
Hardware intel r2308wftzs - No
Hardware intel r2308wttysr - No
Hardware intel r2312wf0np - No
Hardware intel r2312wfqzs - No
Hardware intel r2312wftzs - No
Hardware intel r2312wttysr - No
Hardware intel s2600kpfr - No
Hardware intel s2600kpr - No
Hardware intel s2600kptr - No
Hardware intel s2600stb - No
Hardware intel s2600stq - No
Hardware intel s2600tpfr - No
Hardware intel s2600tpnr - No
Hardware intel s2600tpr - No
Hardware intel s2600tptr - No
Hardware intel s2600wfo - No
Hardware intel s2600wfq - No
Hardware intel s2600wft - No
Hardware intel s2600wt2r - No
Hardware intel s2600wttr - No
Hardware intel s2600wtts1r - No
Hardware intel s7200apr - No
References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For intel's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.