{"id":"CVE-2017-5689","kind":"vulnerability","aliases":["CVE-2017-5689"],"related":[],"title":"Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability: Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability","description":"An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).","summary":"Intel AMT, SBT and Standard Manageability firmware contains a privilege escalation flaw that lets an attacker gain control of the management engine. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":10.0,"epss":0.92189,"exploited":true,"exploited_at":"2022-01-28T00:00:00+00:00","products":[{"name":"Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["amt","enterprise-endpoints","exploited","infrastructure","intel","self-hosted","windows"],"not_affected_if":["amt-disabled","no-intel-amt"],"how_to_check":null,"fix":"Apply the firmware and driver updates from Intel per vendor instructions; the sources do not list affected or fixed versions.","status":"open","published_at":"2017-05-02T14:59:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:29:01+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:29:01Z","model":"claude-haiku-5-5","output":{"fix":"Apply the firmware and driver updates from Intel per vendor instructions; the sources do not list affected or fixed versions.","reach":"unknown","impact":"high","summary":"Intel AMT, SBT and Standard Manageability firmware contains a privilege escalation flaw that lets an attacker gain control of the management engine. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["intel","amt","self-hosted","windows","enterprise-endpoints"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker escalates privileges and takes over the management engine on the machine","analyst_note":"Find Intel's advisory (INTEL-SA-00075) for affected firmware versions, fixed versions and how to detect whether AMT is enabled.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-intel-amt","amt-disabled"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000471,"input_tokens":2888,"output_tokens":364,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2017':29A,32A '-5689':30A,33A 'activ':2A,14A,83B,102C,131C 'active':35A 'amt':5A,17A,38A,46B,58B,105C,134C 'and':43A 'attack':72B,91C,114C 'busi':7A,19A,142C 'business':40A 'cisa':79B 'contain':64B 'control':74B 'could':92C,115C 'cve':28A,31A 'endpoint':49B 'engin':78B 'enterpris':48B 'enterprise-endpoint':47B 'escal':26A,67B 'exploit':50B,84B 'featur':118C 'firmwar':63B 'flaw':68B 'gain':73B,93C,119C 'host':55B 'infrastructur':51B 'intel':1A,13A,34A,52B,57B,98C,101C,107C,127C,130C,135C,140C 'ism':110C,138C 'let':70B 'list':80B 'local':113C,123C 'manag':3A,12A,15A,24A,62B,77B,99C,103C,109C,117C,128C,132C,137C 'manageability':45A 'management':36A 'network':90C,121C 'privileg':25A,66B,95C,125C 'provis':97C,116C 'sbt':9A,21A,42A,59B,144C 'self':54B 'self-host':53B 'skus':100C,129C 'small':6A,18A,39A,141C 'standard':11A,23A,44A,61B,108C,136C 'system':94C,124C 'technolog':4A,8A,16A,20A,104C,133C,143C 'technology':37A,41A 'unprivileg':89C,112C,120C 'vulner':27A 'wild':87B 'window':56B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-05-02T14:59:00+00:00","kev":{"dateAdded":"2022-01-28","dueDate":"2022-07-28","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-5689","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-5689","severity":null,"published_at":"2022-01-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2017-5689","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-5689","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-5689","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5689","severity":null,"published_at":"2017-05-02T14:59:00+00:00","modified_at":"2026-06-17T01:21:02+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}