Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unau…

published 2018-09-12 8y ago modified 2026-06-17 4mo ago also EUVD-2018-15470

cvss: 5.9; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.4%; EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits: 0; none known

Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain the TLS session key via the network.

Patch / fix

fixed in 14 links 1

intel converged_security_management_engine_firmware 12.0.5
intel active_management_technology_firmware 12.0.5
intel manageability_engine_firmware 11.0
siemens simatic_field_pg_m5_firmware 22.01.06
siemens simatic_ipc427e_firmware 21.01.09
siemens simatic_ipc477e_firmware 21.01.09
siemens simatic_ipc547e_firmware r1.30.0
siemens simatic_pc547g_firmware r1.23.0
siemens simatic_ipc627d_firmware 19.02.11
siemens simatic_ipc647d_firmware 19.01.14
siemens simatic_ipc677d_firmware 19.02.11
siemens simatic_ipc827d_firmware 19.02.11
siemens simatic_ipc847d_firmware 19.01.14
siemens simatic_itp1000_firmware 23.01.04

cert-portal.siemens.com/productcert/pdf/ssa-377318.pdf advisory

Is CVE-2018-3616 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-19-043-05 updated 2020-02-10 cvss 5.9

Siemens Intel Active Management Technology of SIMATIC IPCs

Siemens SIMATIC FieldPG M5 <V22.01.06
affected: fixed in V22.01.06, mitigation
Siemens SIMATIC IPC427E (incl. SIPLUS variants) <V21.01.09 Siemens SIMATIC IPC477E <V21.01.09
affected: fixed in V21.01.09, mitigation
Siemens SIMATIC IPC547E <R1.30.0 Siemens SIMATIC IPC547G <R1.23.0
affected: vendor fix, mitigation
Siemens SIMATIC IPC627D <V19.02.11
affected: fixed in V19.02.11, mitigation
Siemens SIMATIC IPC647D <V19.01.14
affected: fixed in V19.01.14, mitigation
Siemens SIMATIC IPC677D <V19.02.11 Siemens SIMATIC IPC827D <V19.02.11
affected: fixed in V19.02.11, mitigation
Siemens SIMATIC IPC847D <V19.01.14
affected: fixed in V19.01.14, mitigation
Siemens SIMATIC ITP1000 <V23.01.04
affected: fixed in V23.01.04, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

2.39% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

Intel Corporation Intel(R) Active Management Technology

References

cert-portal.siemens.com /productcert/pdf/ssa-377318.pdf
patch, third-party-advisory
intel.com /content/www/us/en/security-center/advisory/intel-sa-00141.html
vendor-advisory
ics-cert.us-cert.gov /advisories/ICSA-19-043-05
third-party-advisory, us-government-resource
securityfocus.com /bid/106996
vdb-entry, third-party-advisory
support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03876en_us
third-party-advisory
security.netapp.com /advisory/ntap-20180924-0003/
third-party-advisory

Sources

CVE List CVE-2018-3616
NVD CVE-2018-3616

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.