CVE-2023-28743

Vulnerability

Improper input validation exists in the BIOS firmware of certain Intel NUC devices prior to version QN0073. This vulnerability, identified in Intel security advisory INTEL-SA-01009 [1], allows a privileged user to potentially escalate their privileges through local access.

Exploitation

An attacker must already have privileged access to the system (e.g., administrative or root-level access) to exploit this vulnerability. The exploitation is performed locally, requiring the attacker to interact with the BIOS firmware interface or trigger the input validation flaw through a local attack vector [1].

Impact

Successful exploitation enables the attacker to escalate their privileges further, potentially gaining full control over the system's firmware or higher-level operating system privileges. This could lead to complete compromise of the affected device [1].

Mitigation

Intel has released BIOS version QN0073 to address this vulnerability. Users should update their Intel NUC BIOS to this version or later. No workarounds are mentioned in the advisory [1]. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.