Intel E810 NVM Update Utility Privilege Escalation (INTEL-SA-01295/CVE-2025-20628)

Critical Vulnerability Information Intel ID: INTEL-SA-01295 Category: Software Vulnerability Impact: Escalation of Privilege Severity Rating: MEDIUM Original Release Date: 05/13/2025 Last Revised Date: 05/13/2025 Vulnerability Details CVE ID: CVE-2025-20628 Description: In certain Intel® Ethernet Network Adapter E810 Series NVM Update Utilities, improper inheritance of permissions may allow an authenticated user with local access to potentially escalate privileges. CVSS Base Score 3.1: 6.7 Medium CVSS Vector 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:A/H CVSS Base Score 4.0: 5.4 Medium CVSS Vector 4.0: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:R/VCH:V/AH/SCN:SIN:SA/N Affected Products NVM Update Utility for Intel® Ethernet Network Adapter E810 Series prior to version 4.6. Recommendations Intel recommends updating to version 4.6 or later. The update can be downloaded from the following location: - https://www.intel.com/content/www/us/en/download/19624/non-volatile-memory-nvm-update-utility-for-intel-ethernet-network-adapter-e810-series.html Acknowledgments Intel thanks Aobo Wang from Chaotic Security Research Lab for reporting this issue. Legal Disclaimer and Notices Intel provides materials "as is" without any express or implied warranties. All dates, data, and specifications are preliminary estimates based on current expectations and may be changed without notice. Intel products and services may contain design defects or errors (referred to as "flaws") that may cause products to deviate from published specifications or features. For information on available corrections, see http://intel.com/support. Intel products that have reached their end-of-life update period may no longer receive feature and security updates. For detailed information on support and services, refer to the help article. The features and benefits of Intel technologies depend on system configuration and may require hardware, software, or service activation. Performance varies by usage, configuration, and other factors. No product or component can be absolutely secure. Contact your system manufacturer or retailer, or visit http://intel.com for more information. Some results are derived from internal Intel analysis or architectural simulation or modeling and are provided for informational purposes. Differences in your system may affect your actual performance. © Intel Corporation. Intel, the Intel logo, and other Intel trademarks are trademarks of Intel Corporation or its subsidiaries in the United States and other countries. Other names and brands may be the property of others.

Goal Reached Thanks to every supporter — we hit 100%!

Intel E810 NVM Update Utility Privilege Escalation (INTEL-SA-01295/CVE-2025-20628)