Improper input validation in DHCPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may…

published 2020-06-15 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-2094

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.3%; EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits: 0; none known

Improper input validation in DHCPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentially enable information disclosure via network access.

Patch / fix

fixed in 2

intel service_manager 11.8.77, 11.12.77, 11.22.77, 12.0.64
intel active_management_technology_firmware 11.8.77, 11.12.77, 11.22.77, 12.0.64

Exploit prediction

2.27% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

n/a Intel(R) AMT and Intel(R) ISM

Classification

Weakness

CWE-20 Improper Input Validation

References

intel.com /content/www/us/en/security-center/advisory/intel-sa-00295.html
vendor-advisory
security.netapp.com /advisory/ntap-20200611-0007/
synology.com /security/advisory/Synology_SA_20_15
third-party-advisory
support.lenovo.com /de/en/product_security/len-30041

Sources

CVE List CVE-2020-0596
NVD CVE-2020-0596

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary