{"vulnerability": "cve-2020-12359", "sightings": [{"uuid": "a0588743-b1dd-46e8-b68c-5621c8a2f682", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-12359", "type": "exploited", "source": "Telegram/6OPUWYP6Xw3r-HG5oXkj69p0s_-TG6H6NW7RPOzozjXRRSk", "content": "", "creation_timestamp": "2021-06-10T02:58:20.000000Z"}, {"uuid": "cd652319-f81c-4b28-9e28-4356d0532e75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-12359", "type": "seen", "source": "https://t.me/hacking_Attack/12178", "content": "S firmware, allowing escalation of privilege via local or physical access:\n\n* CVE-2020-12357\u00a0Rating: High / CVSS 7.5* CVE-2020-8670\u00a0Rating: High / CVSS 7.5CVE-2020-8700\u00a0Rating: High / CVSS 7.5CVE-2020-12359\u00a0Rating: High / CVSS 7.5See Also: Offensive Security Tool: Pacu \u2013 The Amazon Web Services Exploitation Framework The Bad Security Library BugIntel also patched a high-severity bug\u00a0in Intel Security Library that affects iterations before version 3.3 and may allow escalation of privilege, denial of service or information disclosure. It\u2019s caused by a key exchange without entity authentication that enables authenticated attackers to escalate privilege via network access. CVE-2021-0133\u00a0was issued a CVSS rating of 7.7.\n\nIntel also patched 11 other high-severity security that affect Intel NUCs, Intel Driver and Support Assistant (DSA), Intel RealSense ID, Intel Field Programmable Gate Array (FPGA) Open Programmable Acceleration Engine (OPAE) driver for Linux, and Intel Thunderbolt controllers. Focus on Privilege EscalationImmersive Labs\u2019 Kevin Breen, director of cyber threat research, noted that the theme for Intel\u2019s June patch set seems to be privilege escalation. \u201cThe higher-rated vulnerabilities in this release seem to focus around resolving privilege escalation vulnerabilities,\u201d he observed to Threatpost via email on Wednesday.\n\n\u201cInterestingly, it\u2019s in the firmware that controls the CPUs, not in the host operating system,\u201d he continued. \u201cWe\u2019re used to automatically applying updates for operating systems and software products \u2013 and even then we still occasionally see updates that result in the dreaded blue screen of death.\u201d\n\nApplying firmware updates is not as well-managed as software updates, he noted, likely because they\u2019re tougher to test \u2026 which means they pack more inherent risk. \u201cAs these have a lower level of interaction with your hardware, there\u2019s no easy way to test them before deploying across your network,\u201d Breen said. \u201cThis means there is more inherent risk with these kinds of patches and updates.\u201d See Also: Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat While hardware exploitation is \u201ca lot harder for attackers to weaponize,\u201d Breen said, attackers know that firmware isn\u2019t updated as frequently as operating systems. That makes firmware exploits a tempting target for threat groups with the technical savvy to create exploits, he predicted: \u201cCreating these exploits would be high on their list for development.\u201d\n\nThe regular \u201cpatch fast\u201d advice applies, Breen said: \u201cAs always, understand your risk and apply patches in the shortest time possible,\u201d he said. \u201cIf you have to delay patching to accommodate more testing, consider adding extra monitoring around the services and hosts that would be vulnerable to shorten response times.\u201d\n\nDirk Schrader, global vice president of security research at New Net Technologies, agreed that focusing on privilege escalation is the key to Intel\u2019s June 2021 security advisories release. He told Threatpost on Wednesday that these newly patched flaws might not be the most critical vulnerabilities an attacker would want to exploit, but \u201cthey are certainly of use in an attack script.\u201d\n\nVia email, Schrader pointed out that \u201cany attack uses a couple of vulnerabilities, and those allowing for privilege escalation are sought after in the later stages of an attack after initial exploits or phishes have opened a door.\u201d \nHe suggested that restricting user privileges is a central element of any security guideline, be it NIST, CIS, or any sector-specific one. \u201cHaving exploits in their arsenal to escape from these restrictions is vital to attackers, and companies are well-advised to follow up on the security advisories released by Intel today,\u201d Schrader advised. \u201cAny company should make it hard for attackers, as hard as possible all along the way into the infrastructure, and not just buil[...]", "creation_timestamp": "2026-09-01T20:02:36.717666Z"}, {"uuid": "3d4cdad0-25ab-418b-8e9d-fcf7a95a9627", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-12359", "type": "seen", "source": "https://t.me/hacking_Attack/12178", "content": "S firmware, allowing escalation of privilege via local or physical access:\n\n* CVE-2020-12357\u00a0Rating: High / CVSS 7.5* CVE-2020-8670\u00a0Rating: High / CVSS 7.5CVE-2020-8700\u00a0Rating: High / CVSS 7.5CVE-2020-12359\u00a0Rating: High / CVSS 7.5See Also: Offensive Security Tool: Pacu \u2013 The Amazon Web Services Exploitation Framework The Bad Security Library BugIntel also patched a high-severity bug\u00a0in Intel Security Library that affects iterations before version 3.3 and may allow escalation of privilege, denial of service or information disclosure. It\u2019s caused by a key exchange without entity authentication that enables authenticated attackers to escalate privilege via network access. CVE-2021-0133\u00a0was issued a CVSS rating of 7.7.\n\nIntel also patched 11 other high-severity security that affect Intel NUCs, Intel Driver and Support Assistant (DSA), Intel RealSense ID, Intel Field Programmable Gate Array (FPGA) Open Programmable Acceleration Engine (OPAE) driver for Linux, and Intel Thunderbolt controllers. Focus on Privilege EscalationImmersive Labs\u2019 Kevin Breen, director of cyber threat research, noted that the theme for Intel\u2019s June patch set seems to be privilege escalation. \u201cThe higher-rated vulnerabilities in this release seem to focus around resolving privilege escalation vulnerabilities,\u201d he observed to Threatpost via email on Wednesday.\n\n\u201cInterestingly, it\u2019s in the firmware that controls the CPUs, not in the host operating system,\u201d he continued. \u201cWe\u2019re used to automatically applying updates for operating systems and software products \u2013 and even then we still occasionally see updates that result in the dreaded blue screen of death.\u201d\n\nApplying firmware updates is not as well-managed as software updates, he noted, likely because they\u2019re tougher to test \u2026 which means they pack more inherent risk. \u201cAs these have a lower level of interaction with your hardware, there\u2019s no easy way to test them before deploying across your network,\u201d Breen said. \u201cThis means there is more inherent risk with these kinds of patches and updates.\u201d See Also: Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat While hardware exploitation is \u201ca lot harder for attackers to weaponize,\u201d Breen said, attackers know that firmware isn\u2019t updated as frequently as operating systems. That makes firmware exploits a tempting target for threat groups with the technical savvy to create exploits, he predicted: \u201cCreating these exploits would be high on their list for development.\u201d\n\nThe regular \u201cpatch fast\u201d advice applies, Breen said: \u201cAs always, understand your risk and apply patches in the shortest time possible,\u201d he said. \u201cIf you have to delay patching to accommodate more testing, consider adding extra monitoring around the services and hosts that would be vulnerable to shorten response times.\u201d\n\nDirk Schrader, global vice president of security research at New Net Technologies, agreed that focusing on privilege escalation is the key to Intel\u2019s June 2021 security advisories release. He told Threatpost on Wednesday that these newly patched flaws might not be the most critical vulnerabilities an attacker would want to exploit, but \u201cthey are certainly of use in an attack script.\u201d\n\nVia email, Schrader pointed out that \u201cany attack uses a couple of vulnerabilities, and those allowing for privilege escalation are sought after in the later stages of an attack after initial exploits or phishes have opened a door.\u201d \nHe suggested that restricting user privileges is a central element of any security guideline, be it NIST, CIS, or any sector-specific one. \u201cHaving exploits in their arsenal to escape from these restrictions is vital to attackers, and companies are well-advised to follow up on the security advisories released by Intel today,\u201d Schrader advised. \u201cAny company should make it hard for attackers, as hard as possible all along the way into the infrastructure, and not just buil[...]", "creation_timestamp": "2026-09-02T01:03:12.930116Z"}]}