CVE-2017-5698

Vulnerability

Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT) firmware versions 11.0.25.3001 and 11.0.26.3000 contain an anti-rollback protection bypass vulnerability. The firmware does not prevent upgrading to version 11.6.x.1xxx, which is known to be vulnerable to CVE-2017-5689 [1]. This enables a downgrade-style attack that bypasses the intended rollback prevention mechanism.

Exploitation

A local user with administrative privileges can perform the upgrade to the vulnerable 11.6.x.1xxx firmware [1]. The attacker must have physical or remote administrative access to the system. No user interaction beyond the attacker's own privileges is required; the attacker directly initiates the firmware upgrade process.

Impact

Successful exploitation leads to the system being placed in a state where it is susceptible to CVE-2017-5689, which allows arbitrary code execution with kernel or System Management Mode (SMM) privileges [1]. The attacker effectively bypasses firmware integrity protections, gaining a persistent foothold at the firmware level.

Mitigation

Intel has published guidance and recommends updating to firmware versions that are not affected by this anti-rollback bypass [1]. Affected users should apply the latest firmware updates available from their system manufacturer (OEM) to remove the vulnerable 11.6.x.1xxx upgrade path. If no OEM update is available, organizations should restrict administrative access to trusted users only.