Skip to content
Fencer Vulns
high 7.8

CVE-2017-5711 json

Multiple buffer overflows in Active Management Technology (AMT) in Intel Manageability Engine Firmware 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.…

published 2017-11-21 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-14788

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

Multiple buffer overflows in Active Management Technology (AMT) in Intel Manageability Engine Firmware 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code with AMT execution privilege.

Patch / fix

  • siemens simatic_field_pg_m3_firmware 6.2.61.3535
  • siemens simatic_field_pg_m4_firmware 18.01.06
  • siemens simatic_field_pg_m5_firmware 22.01.04
  • siemens simatic_ipc677c_firmware 6.2.61.3535
  • siemens simatic_ipc427e_firmware 21.01.07
  • siemens simatic_ipc477e_firmware 21.01.07
  • siemens simatic_ipc547d_firmware 7.1.91.3272
  • siemens simatic_ipc547e_firmware 9.1.41.3024
  • siemens simatic_ipc627c_firmware 6.2.61.3535
  • siemens simatic_ipc627d_firmware 9.1.41.3024
  • siemens simatic_ipc647c_firmware 6.2.61.3535
  • siemens simatic_ipc647d_firmware 9.1.41.3024
  • siemens simatic_ipc677d_firmware 9.1.41.3024
  • siemens simatic_ipc827c_firmware 6.2.61.3535
  • siemens simatic_ipc827d_firmware 9.1.41.3024
  • siemens simatic_ipc847c_firmware 6.2.61.3535
  • siemens simatic_ipc847d_firmware 9.1.41.3024
  • siemens simatic_itp1000_firmware 23.01.03
  • siemens simotion_p320-4s_firmware 17.02.06.83.1
  • siemens sinumerik_pcu50.5-c_firmware 6.2.61.3535

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Intel Corporation Active Management Technology

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.