Intel Active Management Technology / Standard Manageability: An authentication bypass in the AMT web interface: sending

Impact

An authentication bypass in the AMT web interface: sending an empty response hash is accepted as valid, so an unauthenticated network attacker gets full AMT administrative control. AMT provides out-of-band power control, KVM and virtual media below the OS, so this is total control of the machine from the management network, invisible to anything running on the host. Listed in CISA's Known Exploited Vulnerabilities catalog.

Who can reach it

Any attacker who can reach the AMT ports (16992/16993/16994/16995, and 623/664) on a provisioned machine. If your management network is flat or reachable from tenant VLANs, that is everyone.

What to do

Update Intel CSME/AMT firmware via the OEM. Where firmware is unavailable, unprovision AMT and block the AMT ports at the network layer - that is the mitigation that actually deploys on the same day. Firmware update requires an OEM package, a drain and a reboot. Any machine exposed while vulnerable should be treated as compromised at the firmware level, since AMT access permits persistent implantation below the OS.

References