Technical impact
Uncontrolled manipulation of the system search path allows a local attacker with authenticated user privileges to execute arbitrary code at higher privilege levels. The vulnerability exists in the Intel Server Firmware Update Utility and could lead to unauthorized modification of files, disclosure of sensitive data, or denial of service for system functions. "Confidentiality, integrity, and availability" of the affected system might be severely compromised if the attacker achieves escalation.
Affected Systems
The Intel Server Firmware Update Utility, versions prior to 16.0.12, on servers running Intel firmware infrastructure are vulnerable. Systems that still use older builds of the utility are at risk of privilege exploitation through this flaw.
Risk and Exploitability
The CVSS score of 5.4 indicates a moderate impact. EPSS is not available and the flaw is not listed in CISA KEV, suggesting limited current exploitation evidence. The attacker must have local authenticated access and achieve a high complexity attack, typically involving active user interaction or modification of the PATH environment or placement of malicious binaries in directories that are searched. Once an attacker can redirect the search path, execution of attacker‑controlled code occurs with elevated privileges, thus generating a high impact on confidentiality, integrity, and availability.
