CVE-2017-5689
Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability
Description
CVE-2017-5689 is a CRITICAL privilege escalation vulnerability in Intel Active Management Technology (AMT), Intel Small Business Technology (SBT), and Intel Standard Manageability firmware. Classified under CWE-269 (Improper Privilege Management), the flaw allows an unauthenticated remote attacker to gain full control of affected systems through the AMT web interface by sending a crafted authentication response. With a CVSS 3.1 score of 9.8, this vulnerability requires no authentication, no user interaction, and is exploitable over the network with low complexity. CISA added CVE-2017-5689 to its KEV catalog on January 28, 2022, with a remediation deadline of July 28, 2022. The EPSS score of 0.94194 (99.92nd percentile) places it among the most actively exploited vulnerabilities, reflecting the extreme risk posed by hardware-level remote access bypass.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| hpe | proliant ml10 gen9 server firmware | 5.0 |
| siemens | simatic itp1000 firmware | < 9.1.41.3024 |
| siemens | simatic ipc847d firmware | < 9.1.41.3024 |
| siemens | simatic ipc847c firmware | < 6.2.61.3535 |
| siemens | simatic ipc827d firmware | < 9.1.41.3024 |
| siemens | simatic ipc827c firmware | < 6.2.61.3535 |
| siemens | simatic ipc677d firmware | < 9.1.41.3024 |
| siemens | simatic ipc677c firmware | < 6.2.61.3535 |
| siemens | simatic ipc647d firmware | < 9.1.41.3024 |
| siemens | simatic ipc647c firmware | < 6.2.61.3535 |
| siemens | simatic ipc627d firmware | < 9.1.41.3024 |
| siemens | simatic ipc627c firmware | < 6.2.61.3535 |
| siemens | simatic ipc547g firmware | < 11.0.26.3000 |
| siemens | simatic ipc547e firmware | < 9.1.41.3024 |
| siemens | simatic ipc547d firmware | < 7.1.91.3272 |
| siemens | simatic ipc477e firmware | < 21.01.05 |
| siemens | simatic ipc477d firmware | - |
| siemens | simatic field pg m3 firmware | < 6.2.61.3535 |
| siemens | simatic field pg m4 firmware | < 18.01.06 |
| siemens | simatic field pg m5 firmware | < 22.01.03 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html(Patch, Third Party Advisory)
- http://www.securityfocus.com/bid/98269(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038385(Broken Link, Third Party Advisory, VDB Entry)
- https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf(Third Party Advisory)
- https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf(Broken Link)
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us(Third Party Advisory)
- https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr(Patch, Vendor Advisory)
- https://security.netapp.com/advisory/ntap-20170509-0001/(Third Party Advisory)
- https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf(Broken Link, Exploit, Technical Description, Third Party Advisory)
- https://www.embedi.com/news/mythbusters-cve-2017-5689(Broken Link, Third Party Advisory)
- https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability(Technical Description, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5689(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
Improper Privilege Management occurs when a system fails to properly assign, modify, track, or validate privileges for users, processes, or other actors. This weakness class encompasses a range of authorization failures, from inadequate access controls on administrative functions to incorrect privilege checks that allow unauthorized escalation. When privilege management is flawed, lower-privileged or unauthenticated users can access functionality reserved for administrators, effectively bypassing the entire security model of the affected system.
In CVE-2017-5689, the Intel AMT web interface contains a critical authentication bypass in its HTTP digest authentication implementation. The AMT firmware processes authentication responses from the client, but the validation logic contains a flaw that allows an attacker to supply a specially crafted (or even empty) authentication response that the system incorrectly accepts as valid. Since Intel AMT operates at the hardware/firmware level below the operating system, successful exploitation grants full out-of-band remote management capabilities regardless of the state of the operating system, including the ability to power on, reboot, access the BIOS, mount remote media, and interact with the system at the keyboard/video/mouse level. Learn more about Improper Privilege Management (CWE-269)
Impact Analysis
CVE-2017-5689 has a CVSS 3.1 base score of 9.8 (CRITICAL), reflecting the maximum impact with minimal attack prerequisites.
Confidentiality (High): Intel AMT provides out-of-band management capabilities that operate independently of the host operating system. An attacker with unauthorized AMT access can read the system's screen output, access BIOS settings, mount remote storage media, and intercept all keyboard and mouse input. This provides access to any data displayed on screen, stored credentials entered during login, and the ability to boot from external media to directly access the filesystem, bypassing all OS-level access controls, disk encryption notwithstanding.
Integrity (High): Full AMT access allows the attacker to modify BIOS settings, boot from attacker-controlled media, install rootkits or bootloaders that persist below the operating system, and remotely control the system's keyboard and mouse to execute any operation. The attacker can alter firmware settings, disable security features like Secure Boot, and install persistent implants that survive operating system reinstallation since AMT operates at the hardware management layer.
Availability (High): An attacker can remotely power off the system, force reboots, alter boot configurations to prevent normal startup, or continuously disrupt operations through the out-of-band management channel. Since AMT operates independently of the OS, these actions cannot be prevented or detected by host-based security tools running within the operating system.
Scope (Unchanged): While formally unchanged, the practical impact extends well beyond the AMT interface itself. Control over AMT effectively means control over the entire physical system, making the scope distinction largely academic. The EPSS score of 0.94194 (99.92nd percentile) confirms this is among the most exploited CVEs in existence.
Exploit Maturity
Active Exploitation: CVE-2017-5689 is confirmed as actively exploited in the wild. CISA listed it in the Known Exploited Vulnerabilities catalog on January 28, 2022, with a federal remediation deadline of July 28, 2022. The vulnerability attracted immediate attention from threat actors due to the unprecedented level of remote access it provides to affected systems.
Ransomware Association: The CISA KEV catalog does not associate CVE-2017-5689 with known ransomware campaigns. However, the level of access provided (full hardware-level remote control) makes it an ideal vector for any type of attack, including ransomware deployment.
Public Exploits: Detailed technical analysis was published by Embedi in a whitepaper titled "Silent Bob is Silent" which documented the authentication bypass mechanism. Tenable published a blog post with additional technical details. Multiple proof-of-concept exploits are publicly available, and scanning tools to identify vulnerable AMT instances have been widely distributed.
EPSS Context: The EPSS score of 0.94194 (99.92nd percentile) is one of the highest scores observed, indicating near-certain exploitation activity. This reflects the combination of trivial exploitation, massive impact, and the large installed base of Intel AMT-capable systems in enterprise environments.
KEV Deadline: The federal remediation deadline was July 28, 2022. All organizations with Intel vPro or AMT-capable hardware should verify their firmware status regardless of this date.
Remediation
-
Apply Intel firmware updates immediately. Download and install the updated firmware from Intel's security advisory INTEL-SA-00075. This update corrects the authentication bypass in the AMT web interface. Work with your hardware vendor (HP, Dell, Lenovo, etc.) to obtain platform-specific firmware updates.
-
Run Intel's detection and mitigation tool. Intel released a discovery tool to identify systems with vulnerable AMT firmware. Run this tool across all enterprise systems to determine which machines require firmware updates. Prioritize internet-facing systems and those in sensitive network segments.
-
Disable AMT if not in use. If your organization does not actively use Intel AMT for remote management, disable it in the BIOS settings. This eliminates the attack surface entirely. Verify that AMT ports (16992/TCP for HTTP, 16993/TCP for HTTPS) are not listening after disabling.
-
Block AMT ports at the network perimeter. Ensure that firewall rules block external access to AMT management ports (16992, 16993, 16994, 16995, 623, 664). AMT should never be accessible from the internet. Even on internal networks, restrict AMT access to dedicated management VLANs.
-
Audit AMT access logs for unauthorized activity. Review AMT audit logs for signs of unauthorized access, including unexpected remote sessions, BIOS modifications, or boot from external media events. If unauthorized access is detected, assume full system compromise and reimage affected machines from trusted media.
-
Check third-party vendor advisories. Multiple vendors including Siemens (for SIMATIC IPC systems) and HPE published their own advisories with product-specific firmware updates. Ensure all affected platforms in your environment are covered by applying vendor-specific patches.
Technical Details
CVE-2017-5689 is an authentication bypass vulnerability in the web management interface of Intel Active Management Technology (AMT), affecting firmware versions in Intel manageability products. AMT is a hardware-based remote management technology embedded in Intel vPro processors that operates independently of the host operating system through the Intel Management Engine (ME), a dedicated microprocessor within the chipset.
The vulnerability exists in the HTTP digest authentication implementation used by the AMT web server. When processing authentication responses, the AMT firmware compares the client-supplied authentication digest against the expected value but uses a flawed comparison that can be bypassed by providing a zero-length or specially crafted response string. The authentication check effectively compares an empty or minimal string against the computed digest, and due to the implementation bug, this comparison succeeds, granting full administrative access to AMT functionality.
The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation is trivially simple: an attacker sends a crafted HTTP request to the AMT web interface on port 16992 or 16993 with a manipulated Authorization header, and gains full administrative access. No valid credentials are needed, and the attack works regardless of the state of the host operating system.
The scope of this vulnerability is extraordinary because AMT provides capabilities that transcend normal software access: remote power control, BIOS access, keyboard/video/mouse redirection, serial-over-LAN, IDE redirection for remote boot, and hardware-level event monitoring. These capabilities operate below the OS layer, making them invisible to endpoint security solutions and effective even when the system is powered off (AMT remains active as long as the system has power).
Frequently Asked Questions
What is CVE-2017-5689?
CVE-2017-5689 is a critical authentication bypass vulnerability in Intel Active Management Technology (AMT), Intel Small Business Technology (SBT), and Intel Standard Manageability. It allows an unauthenticated remote attacker to gain full administrative access to AMT's out-of-band management capabilities by exploiting a flaw in the HTTP digest authentication implementation. This provides hardware-level control over the affected system, including remote power, BIOS access, and keyboard/video/mouse control.
Which systems are affected by CVE-2017-5689?
The vulnerability affects Intel systems with AMT, SBT, or Standard Manageability firmware. This includes enterprise desktops and laptops with Intel vPro technology, as well as industrial systems from vendors like Siemens (SIMATIC IPC series) and HPE (ProLiant servers). The affected firmware versions span multiple Intel product generations. Check Intel's advisory INTEL-SA-00075 for specific version details and your hardware vendor's advisory for platform-specific information.
How do I fix CVE-2017-5689?
Apply the firmware update from Intel or your hardware vendor that patches the AMT authentication bypass. If AMT is not required for your operations, disable it in the BIOS. Block AMT ports (16992-16995) at your network perimeter to prevent remote exploitation. After patching, audit AMT logs for signs of unauthorized access and consider reimaging any systems where compromise is suspected.
How severe is CVE-2017-5689?
CVE-2017-5689 is rated CRITICAL with a CVSS 3.1 score of 9.8. Its EPSS score of 0.94194 (99.92nd percentile) is among the highest observed, reflecting extreme exploitation activity. The vulnerability is uniquely dangerous because Intel AMT operates at the hardware level below the operating system, making exploitation invisible to OS-based security tools and granting attackers the most privileged form of remote access possible to the affected system.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.