← Vulnerability feed

Vulnerability record · CVE-2019-14598 · published 13 February 2020

CVE-2019-14598: Intel converged security management engine firmware improper authentication vulnerability

Intel · Converged Security Management Engine Firmware

Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access.

6.7 CVSS 3.1 Medium EPSS 0.45% · top 63.1% CWE-287 · Improper authentication
6.7CVSS 3.1 base score, v2 4.6
0.45%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access.

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://security.netapp.com/advisory/ntap-20200221-0005/ Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00307.html Vendor Advisory
https://security.netapp.com/advisory/ntap-20200221-0005/ Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00307.html Vendor Advisory

Track CVE-2019-14598 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2019-2215Android Binder use-after-free allows kernel privilege escalationCVE-2019-2215 is a use-after-free in binder.c in the Android/Linux kernel that lets a local application escalate privileges to the kernel. It matters…KEVEPSS 72%analysed7.8CVE-2019-13272Linux kernel ptrace credential mishandling allows local root escalationThe Linux kernel before 5.1.17 mishandles credential recording in ptrace_link (kernel/ptrace.c) when a process creates a ptrace relationship, and als…KEVEPSS 52%analysed9.8CVE-2020-8758Intel standard manageability vulnerabilityImproper buffer restrictions in network subsystem in provisioned Intel(R) AMT and Intel(R) ISM versions before 11.8.79, 11.12.79, 11.22.79, 12.0.68 a…EPSS 1.9%9.8CVE-2019-14893Fasterxml jackson-databind information exposure vulnerabilityA flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of ma…EPSS 4.1%9.8CVE-2020-8840Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiC…EPSS 27%9.8CVE-2019-20330Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.EPSS 8.6%9.8CVE-2019-18805Linux kernel integer overflow vulnerabilityAn issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in t…EPSS 3.4%9.8CVE-2019-17531Fasterxml jackson-databind deserialization of untrusted data vulnerabilityA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for …EPSS 5.4%

Source: NIST National Vulnerability Database (record CVE-2019-14598), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.