CVE-2025-24299

Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01328.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:intel:computing_improvement_program:*:*:*:*:*:*:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) La validación de entrada incorrecta para algunos softwares Intel(R) CIP anterior a la versión WIN_DCA_2.4.0.11001 dentro del Anillo 3: Aplicaciones de Usuario puede permitir una escalada de privilegios. Un adversario de software sin privilegios con un usuario autenticado combinado con un ataque de baja complejidad puede habilitar la escalada de privilegios. Este resultado puede ocurrir potencialmente a través de acceso a la red cuando los requisitos de ataque no están presentes sin conocimiento interno especial y no requiere interacción del usuario. La potencial vulnerabilidad puede impactar la confidencialidad (alta), integridad (alta) y disponibilidad (alta) del sistema vulnerable, resultando en impactos subsiguientes de confidencialidad (ninguno), integridad (ninguno) y disponibilidad (ninguno) del sistema.

Information

Published : 2025-11-11 17:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-24299

Mitre link : CVE-2025-24299

CVE.ORG link : CVE-2025-24299

JSON object : View

Products Affected

intel

computing_improvement_program

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-24299", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-24299", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-13T04:55:21.144626Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secure@intel.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "secure@intel.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "secure@intel.com", "affectedData": [{"vendor": "n/a", "product": "Intel(R) CIP software", "versions": [{"status": "affected", "version": "before version WIN_DCA_2.4.0.11001"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-11T17:15:41.440", "references": [{"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01328.html", "tags": ["Vendor Advisory"], "source": "secure@intel.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secure@intel.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}, {"lang": "es", "value": "La validaci\u00f3n de entrada incorrecta para algunos softwares Intel(R) CIP anterior a la versi\u00f3n WIN_DCA_2.4.0.11001 dentro del Anillo 3: Aplicaciones de Usuario puede permitir una escalada de privilegios. Un adversario de software sin privilegios con un usuario autenticado combinado con un ataque de baja complejidad puede habilitar la escalada de privilegios. Este resultado puede ocurrir potencialmente a trav\u00e9s de acceso a la red cuando los requisitos de ataque no est\u00e1n presentes sin conocimiento interno especial y no requiere interacci\u00f3n del usuario. La potencial vulnerabilidad puede impactar la confidencialidad (alta), integridad (alta) y disponibilidad (alta) del sistema vulnerable, resultando en impactos subsiguientes de confidencialidad (ninguno), integridad (ninguno) y disponibilidad (ninguno) del sistema."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:intel:computing_improvement_program:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D1985FF-2EEE-491C-8E9D-93DA3D9B984C", "versionEndExcluding": "2.4.11001"}], "operator": "OR"}]}], "sourceIdentifier": "secure@intel.com"}