← Vulnerability feed

Vulnerability record · CVE-2018-12169 · published 21 September 2018

CVE-2018-12169: Intel core i3 improper authentication vulnerability

Intel · Core I3

Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Processor, 7th Generation Intel Core Processor and 8th Generation Intel Core Processor contains a logic error which may allow physical attacker to potentially bypass firmware authentication.

7.6 CVSS 3.0 High EPSS 0.55% · top 56.4% CWE-287 · Improper authentication
7.6CVSS 3.0 base score, v2 4.6
0.55%EPSS exploitation probability, 30 days
NoNot in CISA KEV
32Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Processor, 7th Generation Intel Core Processor and 8th Generation Intel Core Processor contains a logic error which may allow physical attacker to potentially bypass firmware authentication.

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

32 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/105387 Third Party AdvisoryVDB Entry
https://edk2-docs.gitbooks.io/security-advisory/content/unauthenticated-firmware-chain-of-trust-bypass.html Third Party Advisory
https://support.lenovo.com/us/en/solutions/LEN-20527 MitigationThird Party Advisory
http://www.securityfocus.com/bid/105387 Third Party AdvisoryVDB Entry
https://edk2-docs.gitbooks.io/security-advisory/content/unauthenticated-firmware-chain-of-trust-bypass.html Third Party Advisory
https://support.lenovo.com/us/en/solutions/LEN-20527 MitigationThird Party Advisory

Track CVE-2018-12169 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.3CVE-2018-3615Intel core i3 observable discrepancy vulnerabilitySystems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of inf…EPSS 6.3%6.7CVE-2021-0114Intel atom c3000 insecure default initialization vulnerabilityUnchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via …EPSS 0.27%6.7CVE-2021-0144Intel atom c3000 insecure default initialization vulnerabilityInsecure default variable initialization for the Intel BSSA DFT feature may allow a privileged user to potentially enable an escalation of privilege …EPSS 0.33%6.7CVE-2017-5704Intel core i3 insufficiently protected credentials vulnerabilityPlatform sample code firmware included with 4th Gen Intel Core Processor, 5th Gen Intel Core Processor, 6th Gen Intel Core Processor, and 7th Gen Int…EPSS 0.29%5.6CVE-2018-3620Intel core i3 observable discrepancy vulnerabilitySystems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in th…EPSS 5.6%5.6CVE-2018-3646Intel core i3 information exposure vulnerabilitySystems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in th…EPSS 8.6%5.6CVE-2018-3693Intel atom c vulnerabilitySystems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker wi…EPSS 8.6%5.6CVE-2018-3665Intel core i3 information exposure vulnerabilitySystem software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to …EPSS 0.63%

Source: NIST National Vulnerability Database (record CVE-2018-12169), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.