# CVE-2017-5689

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

- Page: https://www.vulneraibility.com/cve/CVE-2017-5689
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-01-28; CISA due date 2022-07-28
- EPSS: 92.19% (percentile 99.8)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 6 GitHub proofs of concept · 1 Nuclei template (first 2017-05-04)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-02-07)
- Weakness: CWE-269
- Published: 2017-05-02

## Affected versions

- Intel Corporation Intel Active Mangement Technology, Intel Small Business Technology, Intel Standard Manageability: affected fixed in versions 6.2.61.3535, 7.1.91.3272, 8.1.71.3608, 9.1.41.3024, 10.0.55.3000, 11.0.25.3001, and 11.6.27.3264 and later

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
- [other] https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf
- [other] http://www.securityfocus.com/bid/98269
- [other] http://www.securitytracker.com/id/1038385
- [other] https://security.netapp.com/advisory/ntap-20170509-0001/
- [other] https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
- [other] https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
- [other] https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us
- [other] http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- [other] https://www.embedi.com/news/mythbusters-cve-2017-5689
- [other] https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5689

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.