CVE-2022-37341

What it actually does

Improper access control in the manageability firmware of affected Intel Ethernet adapters allows a privileged local user to bypass restrictions and escalate privileges on the host system.

Why it matters to the business

Local administrators could gain unauthorized higher-level control over systems using these network adapters, increasing risk of further compromise in environments where firmware updates are delayed.

How an attack unfolds

An attacker with existing local administrative access on a system using vulnerable Intel Ethernet manageability firmware interacts with the adapter to exploit the access control weakness and obtain escalated privileges.

How to fix it

Apply the latest firmware updates for the affected Intel Ethernet adapters and I225 controllers from the vendor; verify firmware versions after installation and restrict local administrative access where possible.

How to confirm the fix worked

Inventory systems for the presence of affected Intel Ethernet hardware, query current firmware versions against vendor release notes, and confirm that only patched firmware revisions are in use.

Typical attack path

1. Obtain local administrative access on the target system
2. Identify presence of affected Intel Ethernet adapter and manageability firmware
3. Leverage local interface to the firmware to trigger the improper access control condition
4. Escalate privileges on the host operating system

How to detect it

Review system logs and firmware update histories for unexpected changes to Intel Ethernet adapter settings or privilege-related events around the adapter driver; correlate with local administrative logons.

What your security team should do

• Prioritize firmware updates on high-value or internet-facing systems first
• Implement least-privilege policies for local accounts to reduce the chance of initial privileged access
• Monitor vendor advisories for any future firmware releases addressing this issue