CVE-2017-5689

Q: What is the severity of CVE-2017-5689?

CVE-2017-5689 has a CVSS score of 9.8 (CRITICAL). CVE-2017-5689 allows unprivileged attackers to gain system-level access to Intel management features. Both network and local attackers can exploit this to provision Intel Active Management Technology (AMT), Standard Manageability (ISM), or Small Business Technology (SBT). This affects systems with Intel vPro, Xeon, and Core processors with these management features enabled.

9.8 CRITICAL

📋 TL;DR

CVE-2017-5689 allows unprivileged attackers to gain system-level access to Intel management features. Both network and local attackers can exploit this to provision Intel Active Management Technology (AMT), Standard Manageability (ISM), or Small Business Technology (SBT). This affects systems with Intel vPro, Xeon, and Core processors with these management features enabled.

💻 Affected Systems

Products:

Intel Active Management Technology (AMT)
Intel Standard Manageability (ISM)
Intel Small Business Technology (SBT)

Versions: Versions 6.x, 7.x, 8.x, 9.x, 10.x, 11.0, 11.5, 11.6, 11.7, 11.8, 11.9, 11.10, 11.11

Operating Systems: All operating systems running on affected Intel hardware

Default Config Vulnerable: ⚠️ Yes

Notes: Requires Intel management features to be provisioned/enabled. Affects Intel Core vPro, Xeon E3 v5/v6, and other Intel processors with AMT/ISM/SBT.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise allowing remote attackers to execute arbitrary code, persist across reboots, and bypass all security controls including firewalls and endpoint protection.

🟠

Likely Case

Attackers gain persistent remote access to systems, allowing data exfiltration, ransomware deployment, or joining systems to botnets.

🟢

If Mitigated

With AMT/ISM/SBT disabled or properly configured with strong authentication, impact is limited to local privilege escalation only.

🌐 Internet-Facing: HIGH - Attackers can exploit remotely without authentication over HTTP/HTTPS on ports 16992-16995.

🏢 Internal Only: HIGH - Local attackers can exploit to gain network/system privileges even without internet access.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploit tools like 'Silent Bob is Silent' and 'Intel AMT Vulnerability Checker' are publicly available. Attack requires network access to AMT web interface ports.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Intel ME Firmware versions 11.8.50, 11.11.50, 11.22.50 or later

Vendor Advisory: https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf

Restart Required: Yes

Instructions:

1. Download Intel ME Firmware update from manufacturer/OEM website. 2. Run firmware update utility. 3. Reboot system. 4. Verify ME firmware version is patched.

🔧 Temporary Workarounds

Disable Intel AMT/ISM/SBT

all

Disable Intel management features in BIOS/UEFI settings

Block AMT network ports

all

Block ports 16992-16995 at firewall

iptables -A INPUT -p tcp --dport 16992:16995 -j DROP
netsh advfirewall firewall add rule name="Block Intel AMT" dir=in action=block protocol=TCP localport=16992-16995

🧯 If You Can't Patch

Disable Intel AMT/ISM/SBT in BIOS/UEFI settings immediately
Implement strict network segmentation and firewall rules blocking ports 16992-16995

🔍 How to Verify

Check if Vulnerable:

Use Intel-SA-00075 Detection Tool or check ME firmware version with 'wmic /namespace:\\root\wmi path Intel_ME_SystemInfo get FirmwareVersion' on Windows or 'dmidecode -t bios' on Linux

Check Version:

wmic /namespace:\\root\wmi path Intel_ME_SystemInfo get FirmwareVersion

Verify Fix Applied:

Verify ME firmware version is 11.8.50, 11.11.50, 11.22.50 or later using same commands

📡 Detection & Monitoring

Log Indicators:

Failed authentication attempts on AMT web interface
Unexpected provisioning events in Intel ME logs
System logs showing AMT configuration changes

Network Indicators:

Unusual traffic on ports 16992-16995
HTTP/HTTPS requests to AMT web interface from unexpected sources
AMT provisioning requests

SIEM Query:

source_port IN (16992, 16993, 16994, 16995) OR dest_port IN (16992, 16993, 16994, 16995)

📊 Metadata

CVE ID: CVE-2017-5689

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-269

Published: May 2, 2017

Last Updated: October 22, 2025

🔗 References

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch,Third Party Advisory
http://www.securityfocus.com/bid/98269 Broken Link,Third Party Advisory,VDB Entry
http://www.securitytracker.com/id/1038385 Broken Link,Third Party Advisory,VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf Third Party Advisory
https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf Broken Link
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us Third Party Advisory
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr Patch,Vendor Advisory
https://security.netapp.com/advisory/ntap-20170509-0001/ Third Party Advisory
https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf Broken Link,Exploit,Technical Description,Third Party Advisory
https://www.embedi.com/news/mythbusters-cve-2017-5689 Broken Link,Third Party Advisory
https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability Technical Description,Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch,Third Party Advisory
http://www.securityfocus.com/bid/98269 Broken Link,Third Party Advisory,VDB Entry
http://www.securitytracker.com/id/1038385 Broken Link,Third Party Advisory,VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf Third Party Advisory
https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf Broken Link
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us Third Party Advisory
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr Patch,Vendor Advisory
https://security.netapp.com/advisory/ntap-20170509-0001/ Third Party Advisory
https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf Broken Link,Exploit,Technical Description,Third Party Advisory
https://www.embedi.com/news/mythbusters-cve-2017-5689 Broken Link,Third Party Advisory
https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability Technical Description,Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5689

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Active Management Technology Firmware by Intel

Proliant Ml10 Gen9 Server Firmware by Hpe

Simatic Field Pg M3 Firmware by Siemens

Simatic Field Pg M4 Firmware by Siemens

Simatic Field Pg M5 Firmware by Siemens

Simatic Ipc427d Firmware by Siemens

Simatic Ipc427e Firmware by Siemens

Simatic Ipc477d Firmware by Siemens

Simatic Ipc477d Firmware by Siemens

Simatic Ipc477e Firmware by Siemens

Simatic Ipc547d Firmware by Siemens

Simatic Ipc547e Firmware by Siemens

Simatic Ipc547g Firmware by Siemens

Simatic Ipc627c Firmware by Siemens

Simatic Ipc627d Firmware by Siemens

Simatic Ipc627d Firmware by Siemens

Simatic Ipc647c Firmware by Siemens

Simatic Ipc647d Firmware by Siemens

Simatic Ipc677c Firmware by Siemens

Simatic Ipc677d Firmware by Siemens

Simatic Ipc677d Firmware by Siemens

Simatic Ipc827c Firmware by Siemens

Simatic Ipc827d Firmware by Siemens

Simatic Ipc847c Firmware by Siemens

Simatic Ipc847d Firmware by Siemens

Simatic Itp1000 Firmware by Siemens

Simatic Pcs 7 Ipc427e Firmware by Siemens

Simatic Pcs 7 Ipc427e Firmware by Siemens

Simatic Pcs 7 Ipc477d Firmware by Siemens

Simatic Pcs 7 Ipc547d Firmware by Siemens

Simatic Pcs 7 Ipc547e Firmware by Siemens

Simatic Pcs 7 Ipc547g Firmware by Siemens

Simatic Pcs 7 Ipc547g Firmware by Siemens

Simatic Pcs 7 Ipc627c Firmware by Siemens

Simatic Pcs 7 Ipc647c Firmware by Siemens

Simatic Pcs 7 Ipc647d Firmware by Siemens

Simatic Pcs 7 Ipc677c Firmware by Siemens

Simatic Pcs 7 Ipc847c Firmware by Siemens

Simatic Pcs 7 Ipc847d Firmware by Siemens

Simotion P320 4 S Firmware by Siemens

Sinumerik Pcu50.5 P Firmware by Siemens

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable Intel AMT/ISM/SBT

Block AMT network ports

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export