CVE-2023-22444

Vulnerability

An improper initialization vulnerability in the BIOS firmware of multiple Intel® NUC products — including Intel® NUC 13 Extreme Compute Element, Intel® NUC 13 Extreme Kit, Intel® NUC 11 Performance Kit, Intel® NUC 11 Performance Mini PC, Intel® NUC Compute Element, Intel® NUC Laptop Kit, Intel® NUC Pro Kit, Intel® NUC Pro Board, and Intel® NUC Pro Mini PC — may allow a privileged user to disclose sensitive information via local access [1]. The affected BIOS versions and specific NUC models are detailed in the Intel advisory.

Exploitation

An attacker requires local access to the system with elevated privileges [1]. The exact exploitation steps are not disclosed in the available reference, but the vulnerability originates in the BIOS firmware initialization sequence.

Impact

Successful exploitation could lead to information disclosure [1]. The attacker may gain access to sensitive data normally protected by the firmware.

Mitigation

Intel has released BIOS updates to address the vulnerability; the fixed versions are listed in Intel security advisory INTEL-SA-00917 [1]. Users should update their NUC equipment to the latest firmware version provided by the manufacturer.