Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability: Privilege Escalation (CVE-2017-5689)

What is affected, what to do

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Intel Active Mangement Technology, Intel Small Business Technology, Intel Standard Manageability eq fixed in versions 6.2.61.3535, 7.1.91.3272, 8.1.71.3608, 9.1.41.3024, 10.0.55.3000, 11.0.25.3001, and 11.6.27.3264 and later..fixed in versions 6.2.61.3535, 7.1.91.3272, 8.1.71.3608, 9.1.41.3024, 10.0.55.3000, 11.0.25.3001, and 11.6.27.3264 and later

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Apply firmware patch: Intel published fixed firmware under advisory INTEL-SA-00075. Affected versions: 6.x, 7.x, 8.x, 9.x, 10.x, 11.0–11.6. Target versions include 6.2.61.3535, 8.1.71.3608, 9.1.41.3024, 9.5.61.3012, 10.0.55.3000, 11.6.27.3264 (or later). Obtain updates through your OEM (Dell, HP, Lenovo, etc.) — not directly from Intel.
   • Block AMT ports immediately: Drop TCP 16992 (HTTP) and 16993 (HTTPS) at the perimeter firewall and on host-based firewalls for all systems pending patch. Also block 16994/16995 (SOL/IDER) and 623/664.
   • Inventory all AMT-capable systems: Enumerate all Intel vPro assets (Core i5/i7/i9 vPro, Xeon E3 with AMT). Determine provisioning state — unprovisioned SBT SKUs are still vulnerable to local privilege escalation.
   • Isolate AMT management traffic: Restrict AMT ports to a dedicated management VLAN accessible only from authorised management workstations. No direct internet path to AMT ports under any circumstances.
   • Harden MEBx: Change the MEBx password from the default "admin" on all systems immediately. Disable local USB provisioning if configurable in BIOS/MEBx. Disable AMT entirely in MEBx (Manageability Feature Selection → Disabled) where remote management is not required.
   • Triage access logs: Review AMT web interface logs (ports 16992/16993) for unauthenticated or anomalous access over the past 90 days; escalate any hits to full incident response.
2. 02

   Runbook step 2

   Mitigation layers

   • Network layer — IPS rule: Alert or drop HTTP traffic to ports 16992/16993 with an empty or malformed Authorization header: alert tcp any any -> $HOME_NET 16992:16993 (msg:"CVE-2017-5689 AMT Auth Bypass Attempt"; content:"Authorization|3a|"; pcre:"/Authorization:\s*(Digest\s+[^,\n]{0,30})?(\r\n|\n)/i"; sid:2017568901; rev:1;). If AMT is not required, drop all traffic to these ports at the IPS.
   • WAF/reverse proxy: If the AMT web interface is reachable via an internal proxy, add a rule blocking requests to /index.htm and /logon.htm that carry a missing or empty Authorization header.
   • Endpoint hardening: Use Intel MEBx to fully disable AMT where out-of-band management is not operationally required. This requires physical access or an existing secure remote BIOS channel.
   • IAM/least privilege: Ensure all AMT accounts (default: "admin") use strong, unique credentials. Do not synchronise AMT accounts with Active Directory credentials while the patch is pending.
   • Configuration audit: Use Intel CSME System Tools (MEInfo) to verify provisioning state across the fleet: MEInfo.exe -verbose | findstr "Provisioning". Unprovisioned systems carry lower remote-attack risk but remain vulnerable to local provisioning abuse.
3. 03

   Runbook step 3

   Detection rules

   • Network telemetry (Zeek/Suricata): Flag any connection to port 16992 or 16993 originating outside the management VLAN, especially where an HTTP 200 response is returned without a complete authentication handshake. KQL: NetworkEvents | where DestinationPort in (16992, 16993) and not SourceIP in (management_vlan_range).
   • AMT web interface access log: HTTP requests to /index.htm or /logon.htm with a missing or empty Authorization header that receive an HTTP 200 response — this is the primary exploitation signal for the authentication bypass.
   • EDR/Sysmon: Sysmon Event ID 3 (network connection) from LMS.exe (Intel Local Manageability Service) to non-local IP addresses, or unusual child processes spawned by LMS.exe — both indicate potential post-exploitation activity.
   • Sigma rule (network proxy logs): title: CVE-2017-5689 AMT Auth Bypass | logsource: category: proxy | detection: selection: cs-uri-path|contains: ['/index.htm', '/logon.htm'] cs-host|contains: ':16992' http_status: 200 condition: selection | falsepositives: Legitimate AMT admin access | level: critical
   • Configuration change monitoring: Unexpected provisioning state changes on systems previously recorded as "unprovisioned" (detectable via Intel SCS or SCCM AMT plugin) indicate local exploitation of the provisioning vector.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

References & sources

• tenable.comblog/rediscovering-the-intel-amt-vulnerabilityx_refsource_MISC, Technical description, Third-party advisory
• downloadmirror.intel.com26754/eng/INTEL-SA-00075 Mitigation Guide-Rev 1.1.pdfx_refsource_CONFIRM, Broken link
• securityfocus.com98269Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
• securitytracker.com1038385Vulnerability database, x_refsource_SECTRACK, Broken link, Third-party advisory, Vulnerability database
• security.netapp.comadvisory/ntap-20170509-0001x_refsource_CONFIRM, Third-party advisory
• embedi.comfiles/white-papers/Silent-Bob-is-Silent.pdfx_refsource_MISC, Broken link, Exploit, Technical description, Third-party advisory
• security-center.intel.comadvisory.aspx?intelid=INTEL-SA-00075&languageid=en-frx_refsource_CONFIRM, Patch, Vendor advisory
• h20566.www2.hpe.comhpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf037…x_refsource_CONFIRM, Third-party advisory
• oracle.comtechnetwork/security-advisory/cpujul2017-3236622.htmlx_refsource_CONFIRM, Patch, Third-party advisory
• embedi.comnews/mythbusters-cve-2017-5689x_refsource_MISC, Broken link, Third-party advisory
• Siemens ProductCERTproductcert/pdf/ssa-874235.pdfx_refsource_CONFIRM, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5689government-resource, US government resource

Linked advisories

• SSA-874235 (Last Update: 2020-02-10): Intel Vulnerability in Siemens Industrial ProductsSiemens ProductCERT