Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unau…

published 2024-02-23 2 y ago modified 2026-06-17 4 mo ago also EUVD-2021-19861

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 46%
public exploits: 0; none known

Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to potentially enable information disclosure via network access.

Patch / fix

fixed in 2

intel ethernet_controller_i225_manageability_firmware nvm_version_1.87
intel ethernet_adapter 29.0.1

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-05-23)

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

n/a Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware
intel ethernet_controller_i225_manageability_firmware
intel ethernet_adapter

Classification

Weakness

CWE-20 Improper Input Validation
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

intel.com /content/www/us/en/security-center/advisory/intel-sa-00756.html
vendor-advisory

Sources

CVE List CVE-2021-33146
NVD CVE-2021-33146

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary