Skip to content
Fencer Intel
medium 6.1

CVE-2022-37327 json

Improper input validation in BIOS firmware for Intel(R) NUC, Intel(R) NUC Performance Kit, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8…

published 3y ago modified 4mo ago also EUVD-2022-39962

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

Improper input validation in BIOS firmware for Intel(R) NUC, Intel(R) NUC Performance Kit, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element, Intel(R) NUC Extreme, Intel(R) NUC 12 Extreme Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Enthusiast, Intel(R) NUC Essential, Intel(R) NUC Laptop Kit, Intel(R) NUC Extreme Compute Element, Intel(R) NUC Boards, Intel(R) NUC Pro Compute Element, Intel(R) NUC Rugged may allow a privileged user to enable information disclosure via local access.

Patch / fix

  • intel nuc10i3fnh_firmware fncml357.0059
  • intel nuc10i3fnhf_firmware fncml357.0059
  • intel nuc10i3fnhfa_firmware fncml357.0059
  • intel nuc10i3fnhja_firmware fncml357.0059
  • intel nuc10i3fnhn_firmware fncml357.0059
  • intel nuc10i3fnk_firmware fncml357.0059
  • intel nuc10i3fnkn_firmware fncml357.0059
  • intel nuc10i5fnh_firmware fncml357.0059
  • intel nuc10i5fnhca_firmware fncml357.0059
  • intel nuc10i5fnhf_firmware fncml357.0059
  • intel nuc10i5fnhja_firmware fncml357.0059
  • intel nuc10i5fnhj_firmware fncml357.0059
  • intel nuc10i5fnhn_firmware fncml357.0059
  • intel nuc10i5fnk_firmware fncml357.0059
  • intel nuc10i5fnkn_firmware fncml357.0059
  • intel nuc10i5fnkpa_firmware fncml357.0059
  • intel nuc10i5fnkp_firmware fncml357.0059
  • intel nuc10i7fnh_firmware fncml357.0059
  • intel nuc10i7fnhaa_firmware fncml357.0059
  • intel nuc10i7fnhc_firmware fncml357.0059

Is CVE-2022-37327 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • n/a Intel(R) NUC, Intel(R) NUC Performance Kit, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element, Intel(R) NUC Extreme, Intel(R) NUC 12 Extreme Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Enthusiast, Intel(R) NUC Essential, Intel(R) NUC Laptop Kit, Intel(R) NUC Extreme Compute Element, Intel(R) NUC Boards, Intel(R) NUC Pro Compute Element, Intel(R) NUC Rugged

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.