Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-31189

Improper authentication in some Intel(R) Server Product OpenBMC firmware before version egs-1.09 may allow an authenticated user to enable escalation of privilege via local access.

Security Impact Summary

This vulnerability carries a MEDIUM severity rating with a CVSS v3.1 score of 5.2, requiring local system access to exploit with relatively low complexity without requiring user interaction requiring only low-level privileges . The vulnerability impacts limited data confidentiality, limited integrity, for affected systems. Impacting 54 products from intel, from intel, from intel and 51 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2024, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.

Published

2024-02-14T14:15:50.310

Last Modified

2026-01-14T18:29:39.013

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.2 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-287
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System intel openbmc < egs-1.09 Yes
Hardware intel xeon_bronze_3408u - No
Hardware intel xeon_gold_5403n - No
Hardware intel xeon_gold_5411n - No
Hardware intel xeon_gold_5412u - No
Hardware intel xeon_gold_5415\+ - No
Hardware intel xeon_gold_5416s - No
Hardware intel xeon_gold_5418n - No
Hardware intel xeon_gold_5418y - No
Hardware intel xeon_gold_5420\+ - No
Hardware intel xeon_gold_5423n - No
Hardware intel xeon_gold_5433n - No
Hardware intel xeon_gold_6403n - No
Hardware intel xeon_gold_6414u - No
Hardware intel xeon_gold_6416h - No
Hardware intel xeon_gold_6418h - No
Hardware intel xeon_gold_6421n - No
Hardware intel xeon_gold_6423n - No
Hardware intel xeon_gold_6426y - No
Hardware intel xeon_gold_6428n - No
Hardware intel xeon_gold_6430 - No
Hardware intel xeon_gold_6433n - No
Hardware intel xeon_gold_6433ne - No
Hardware intel xeon_gold_6434 - No
Hardware intel xeon_gold_6434h - No
Hardware intel xeon_gold_6438m - No
Hardware intel xeon_gold_6438n - No
Hardware intel xeon_gold_6438y\+ - No
Hardware intel xeon_gold_6442y - No
Hardware intel xeon_gold_6443n - No
Hardware intel xeon_gold_6444y - No
Hardware intel xeon_gold_6448h - No
Hardware intel xeon_gold_6448y - No
Hardware intel xeon_gold_6454s - No
Hardware intel xeon_gold_6458q - No
Hardware intel xeon_platinum_8444h - No
Hardware intel xeon_platinum_8450h - No
Hardware intel xeon_platinum_8452y - No
Hardware intel xeon_platinum_8454h - No
Hardware intel xeon_platinum_8458p - No
Hardware intel xeon_platinum_8460h - No
Hardware intel xeon_platinum_8460y\+ - No
Hardware intel xeon_platinum_8461v - No
Hardware intel xeon_platinum_8462y\+ - No
Hardware intel xeon_platinum_8468 - No
Hardware intel xeon_platinum_8468h - No
Hardware intel xeon_platinum_8468v - No
Hardware intel xeon_platinum_8470 - No
Hardware intel xeon_platinum_8470n - No
Hardware intel xeon_platinum_8471n - No
Hardware intel xeon_platinum_8480\+ - No
Hardware intel xeon_platinum_8490h - No
Hardware intel xeon_silver_4410t - No
Hardware intel xeon_silver_4410y - No
References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For intel's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.