Intel: Security Alert Concerning S4500/S4600 Series Firmware SSD for Data Centers

From Intel Corp.’ Security Center

A potential security vulnerability in Intel Corp.‘s SSD for data centers S4500/S4600 Series firmware may allow escalation of privilege. The company is releasing firmware updates to mitigate this potential vulnerability.

Vulnerability details:

• CVEID: CVE-2018-18095
  Description: Improper authentication in firmware for SSD DC S4500 Series and SSD DC S4600 Series before SCV10150 may allow an unprivileged user to potentially enable escalation of privilege via physical access.

• CVSS Base Score: 5.3 Medium

• CVSS Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Affected Products:

• SSD DC S4500 Series firmware before SCV10150.

• SSD DC S4600 Series firmware before SCV10150.

Recommendations:
The company recommends updating SSD DC S4500 Series and SSD DC S4600 Series firmware to SCV10150 or later.

Updates are available for download at this location.

Acknowledgements:
This issue was found internally by Intel.

The company, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

Revision history