CVE-2020-8745
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11...
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
- Record
CVE-2020-8745- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
- Record
CVE-2020-8745- Updated
- 2026-11-02
EUVDEUVD-2020-29593 No score
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
- Record
EUVD-2020-29593- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wc8w-gx27-xp92
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11...
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
- Record
GHSA-wc8w-gx27-xp92- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
Affected products
- intel converged security and manageability engine
- intel trusted execution technology
- siemens simatic drive controller firmware
- siemens simatic et200sp 1515sp pc2 firmware
- siemens simatic field pg m5 firmware
- siemens simatic field pg m6 firmware
- siemens simatic ipc127e firmware
- siemens simatic ipc427e firmware
- siemens simatic ipc477e firmware
- siemens simatic ipc527g firmware
- siemens simatic ipc547g firmware
- siemens simatic ipc627e firmware
Show 10 moreShow less
- siemens simatic ipc647e firmware
- siemens simatic ipc667e firmware
- siemens simatic ipc847e firmware
- siemens simatic itp1000 firmware
- siemens sinumerik 828d hw pu.4 firmware
- siemens sinumerik 840d sl ht 10 firmware
- siemens sinumerik mc mcu 1720 firmware
- siemens sinumerik one firmware
- siemens sinumerik one ncu 1740 firmware
- siemens sinumerik one ppu 1740 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8745 is a medium vulnerability (CVSS 6.8) in Intel Converged Security And Manageability Engine, published November 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. No source names a fixed version.