NUC8i5BEH CSME Version Detection Tool v7.0.1.0 -> This system is vulnerable

[RvdH]

System Name NUC8I5BEH
System Manufacturer Intel(R) Client Systems
System Model NUC8i5BEH
System Type x64-based PC
System SKU BOXNUC8i5BEH
Processor Intel(R) Core(TM) i5-8259U CPU @ 2.30GHz, 2304 Mhz, 4 Core(s), 8 Logical Processor(s)
BIOS Version/Date Intel Corp. BECFL357.86A.0089.2021.0621.1343, 21-6-2021

[DeividA_Intel]

Hello RvdH,  

Thank you for posting on the Intel® communities. I am sorry to know that you are having issues with your Intel® NUC Kit NUC8i5BEH.  

In order to better assist you, please try the following:  

1. What is the operating system installed and its version (the report does not show it)?

2. Can you provide more details about the issue?

3. Do you have any issues or errors with the tool?

4. If you are getting any errors or alerts from the tool, can you get pictures?

5. How did you notice this vulnerability with the tool and when did it start?

Regards,  

Deivid A. 

Intel Customer Support Technician 

[RvdH]

1. What is the operating system installed and its version (the report does not show it)?

Both Windows 10 and Widows 11 (windows 11 SSU report attached)

2. Can you provide more details about the issue?

Uh, no it is simply what the CSME Version Detection Tool v7.0.1.0 reports back after running it

3. Do you have any issues or errors with the tool?

The tool works OK

4. If you are getting any errors or alerts from the tool, can you get pictures?

5. How did you notice this vulnerability with the tool and when did it start?

With the release of CSME Version Detection Tool v7.0.1.0, in previous version v6.0.1.0 i believe there was no vulnerability being reported

[RvdH]

On the first look of things, reading https://www.intel.com/content/www/us/en/support/articles/000031784/technologies.html i think this is caused either because ME 12.0.81.1753 or the CPU Micrcocode is outdated, right?

[DeividA_Intel]

Hello RvdH, 

Thanks for the information provided. Before I investigate this issue further, please confirm the following:

1. Can you confirm if you updated the Intel® Management Engine Consumer Driver to version 12.0.81.1753?

2. Can you confirm if you updated the BIOS using a BIOS recovery or if you already tried a BIOS recovery?

Regards,  

Deivid A.  

Intel Customer Support Technician  

[RvdH]

1. Can you confirm if you updated the Intel® Management Engine Consumer Driver to version 12.0.81.1753?

Intel Driver and Support assistent says all drivers are up to date, although on Windows 11 ME driver says version: 2102.100.0.1044

2. Can you confirm if you updated the BIOS using a BIOS recovery or if you already tried a BIOS recovery?

I don't remember... i think i updated it using the normal F7 method back in the day, is it worth trying using the BIOS recovery method?

But if it is a drivers/bios issue please explain why any version of the CSME Version Detection Tool prior to version 7.0.1.0 reported no vulnerabilities with the same driver/bios?

[RvdH]

Flashing the bios using the BIOS recovery method makes (as expected) no difference at all 

[DeividA_Intel]

Hello RvdH, 

Thank you for the information provided 

I will proceed to check the issue internally and post back soon with more details. 

Best regards, 

Deivid A.  

Intel Customer Support Technician 

[Ronny_G_Intel]

Hello RvdH,

The CSME tool detects and compares Intel ME versions, if the version detected is not the latest and still vulnerable then it will display the message that you got. The release of new ME happens more frequently than BIOS releases so it is expected that the CSME tool will report "system still vulnerable" at a certain moment while BIOS has not been updated.

The next BIOS release for this platform is currently scheduled for late September, ME FW update is included in the coming update.

I will recommend that you wait for the next BIOS release and run the CSME tool again once the system is updated.

I hope this helps.

Regards,

Ronny G

[RvdH]

@Ronny_G_Intel 

Thank you for your feedback, i'll be monitoring the downloads section around that time

[RvdH]

Today i noticed a BIOS update was listed on top of this page: https://www.intel.com/content/www/us/en/products/sku/126148/intel-nuc-kit-nuc8i5beh/downloads.html 

BIOS Update [BECFL357] 9/22/2022, unfortunately this is still the old bios, eg: Version: 0089 Dated: June 21, 2021

Someone forgot to update the binary?