Intel Server Firmware Update Utility (SysFwUpdt) and Server Configuration Utility before version 16.0.12: Improper

Impact

Improper input validation in the utility operators use to flash BIOS, BMC and ME firmware, letting a privileged local user escalate; the companion issues add an incorrect-permission assignment and a link-following flaw in the same tool family. The irony is the point: the tool you run to remediate firmware is itself the escalation path into firmware. A tenant or a compromised operator account on a node can subvert the update process so that the node ends up running attacker-chosen firmware while your fleet records show a successful patch. That gives below-the-OS persistence that survives reimage and crosses tenant handoff, and it corrupts the evidence you would use to detect it.

Who can reach it

A privileged local user on the host where the utility runs - which includes tenants on bare-metal nodes if the tooling is left in the host image, and any compromised operator or automation account that drives firmware rollouts.

What to do

Update SysFwUpdt and the Server Configuration Utility to 16.0.12 or later before running any further firmware campaigns. Separately, treat firmware update tooling as privileged infrastructure: do not leave it installed in tenant-facing host images, run firmware updates from the BMC/Redfish out-of-band path rather than from the host OS wherever the platform supports it, and verify post-update firmware versions and measurements out of band instead of trusting the tool's own success report.

References