Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-14611

Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.

Security Impact Summary

This vulnerability carries a MEDIUM severity rating with a CVSS v3.1 score of 6.7, requiring local system access to exploit with relatively low complexity without requiring user interaction . The vulnerability impacts confidentiality (data exposure), integrity (unauthorized modifications), and availability (service disruption) for affected systems. Impacting 38 products from intel, from intel, from intel and 35 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

First disclosed in 2019, this vulnerability was reported during a period defined by widespread IoT adoption challenges, mobile security concerns, and the emergence of advanced persistent threat (APT) techniques. Contemporary mitigation strategies focused on secure development practices and third-party component vetting.

Published

2019-12-16T20:15:15.413

Last Modified

2024-11-21T04:27:02.317

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.7 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

3.9

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-190
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System intel nuc_8_mainstream_game_kit_firmware < 0036 Yes
Hardware intel nuc_8_mainstream_game_kit - No
Operating System intel nuc_8_mainstream_game_mini_computer_firmware < 0036 Yes
Hardware intel nuc_8_mainstream_game_mini_computer - No
Operating System intel nuc8i7bek_firmware < 0077 Yes
Hardware intel nuc8i7bek - No
Operating System intel cd1p64gk_firmware < 0053 Yes
Hardware intel cd1p64gk - No
Operating System intel nuc8i3cysm_firmware < 0043 Yes
Hardware intel nuc8i3cysm - No
Operating System intel nuc8i7hnk_firmware < 0059 Yes
Hardware intel nuc8i7hnk - No
Operating System intel nuc7i7dnke_firmware < 0067 Yes
Hardware intel nuc7i7dnke - No
Operating System intel nuc7i5dnke_firmware < 0067 Yes
Hardware intel nuc7i5dnke - No
Operating System intel nuc7i3dnhe_firmware < 0067 Yes
Hardware intel nuc7i3dnhe - No
Operating System intel stk2mv64cc_firmware < 0061 Yes
Hardware intel stk2mv64cc - No
Operating System intel stk2m3w64cc_firmware < 0062 Yes
Hardware intel stk2m3w64cc - No
Operating System intel nuc6i7kyk_firmware < 0066 Yes
Hardware intel nuc6i7kyk - No
Operating System intel nuc6i5syh_firmware < 0072 Yes
Hardware intel nuc6i5syh - No
Operating System intel nuc7cjyh_firmware < 0053 Yes
Hardware intel nuc7cjyh - No
Operating System intel cd1m3128mk_firmware < 0058 Yes
Hardware intel cd1m3128mk - No
Operating System intel cd1iv128mk_firmware < 0038 Yes
Hardware intel cd1iv128mk - No
Operating System intel nuc6cays_firmware < 0064 Yes
Hardware intel nuc6cays - No
Operating System intel de3815tybe_firmware < 0024 Yes
Hardware intel de3815tybe - No
Operating System intel d34010wyb_firmware < 0054 Yes
Hardware intel d34010wyb - No
References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For intel's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.