← Vulnerability feed

Vulnerability record · CVE-2025-24299 · published 11 November 2025

CVE-2025-24299: Intel computing improvement program improper input validation vulnerability

Intel · Computing Improvement Program

Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

8.7 CVSS 4.0 High EPSS 0.32% · top 77.1% CWE-20 · Improper input validation
8.7CVSS 4.0 base score
0.32%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01328.html Vendor Advisory

Track CVE-2025-24299 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2023-35769Intel computing improvement program uncontrolled search path element vulnerabilityUncontrolled search path in some Intel(R) CIP software before version 2.4.10577 may allow an authenticated user to potentially enable escalation of p…EPSS 0.19%7.8CVE-2021-0052Intel computing improvement program improper privilege management vulnerabilityIncorrect default privileges in the Intel(R) Computing Improvement Program before version 2.4.6522 may allow an authenticated user to potentially ena…EPSS 0.22%7.8CVE-2021-0074Intel computing improvement program vulnerabilityImproper permissions in the installer for the Intel(R) Computing Improvement Program software before version 2.4.5982 may allow an authenticated user…EPSS 0.22%7.8CVE-2020-8736Intel computing improvement program vulnerabilityImproper access control in subsystem for the Intel(R) Computing Improvement Program before version 2.4.5718 may allow an authenticated user to potent…EPSS 0.33%7.8CVE-2019-11162Intel computing improvement program vulnerabilityInsufficient access control in hardware abstraction in SEMA driver for Intel(R) Computing Improvement Program before version 2.4.0.04733 may allow an…EPSS 0.38%7.8CVE-2018-12168Intel computing improvement program incorrect permission assignment vulnerabilityPrivilege escalation in file permissions in Intel Computing Improvement Program before version 2.2.0.03942 may allow an authenticated user to potenti…EPSS 0.35%7.7CVE-2025-24838Intel computing improvement program improper privilege management vulnerabilityImproper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalat…EPSS 0.28%7.1CVE-2024-36482Intel computing improvement program improper input validation vulnerabilityImproper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalation of priv…EPSS 0.18%

Source: NIST National Vulnerability Database (record CVE-2025-24299), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.