CVE-2021-33130

Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow an unauthenticated user to potentially enable information disclosure via physical access.

CVSS v3 4.6 MEDIUM
CVSS v2.0 2.1 LOW

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00595.html	Product Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:intel:realsense_id_f450_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:intel:realsense_id_f450:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-05-12 17:15

Updated : 2022-07-12 17:42

NVD link : CVE-2021-33130

Mitre link : CVE-2021-33130

CVE.ORG link : CVE-2021-33130

JSON object : View

Products Affected

intel

realsense_id_f450_firmware
realsense_id_f450

CWE

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2021-33130", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2022-05-12T17:15:09.450", "references": [{"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00595.html", "tags": ["Product", "Vendor Advisory"], "source": "secure@intel.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow an unauthenticated user to potentially enable information disclosure via physical access."}, {"lang": "es", "value": "Una inicializaci\u00f3n no segura de variables por defecto de Intel(R) RealSense(TM) ID Solution F450 versiones anteriores a 2.6.0.74, puede permitir que un usuario no autenticado permita potencialmente una divulgaci\u00f3n de informaci\u00f3n por medio del acceso f\u00edsico"}], "lastModified": "2022-07-12T17:42:04.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:intel:realsense_id_f450_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59BDFE26-E8AC-409A-B162-F26DB6D6D693", "versionEndExcluding": "2.6.0.74"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:intel:realsense_id_f450:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "ECED097D-401C-4E82-B6E3-A8EABAE87A72"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "secure@intel.com"}