Intel SPS firmware: Uncontrolled resource consumption in SPS firmware lets a privileged user deny service

Impact

Uncontrolled resource consumption in SPS firmware lets a privileged user deny service to the management engine over the network. Losing the management engine means losing out-of-band recovery on that node - which is exactly when you need it.

Who can reach it

Privileged user with network access to the affected interface.

What to do

Fixed in Intel CSME/SPS firmware, which reaches you as an OEM BIOS or firmware package - not as a microcode or OS update. That means: wait for your server vendor to ship it, drain the node, flash, and reboot. OEM availability is the long pole and routinely lags the Intel advisory by one or more quarters on server platforms. Track it per platform SKU, because vendors ship these unevenly across their own product lines.

References

Related entries

• Dell PowerEdge Server BIOS + iDRAC9 (information disclosure): Information disclosure spanning both the BIOS and iDRAC9CVE-2025-26482 · Dell PowerEdge Server BIOS + iDRAC9 (information disclosure)Medium
• IBM OpenBMC: password supplied with a resource dump request is written to the BMC audit logCVE-2026-8058 · IBM OpenBMC (resource dump request handling, BMC audit log)Medium
• Lenovo XClarity Controller (XCC): Authorization bypassCVE-2019-6195 · Lenovo XClarity Controller (XCC)Medium
• ARM Trusted Firmware in AMD Zynq UltraScale+ MPSoC/RFSoC: Improper input validation in the ARM Trusted Firmware usedCVE-2023-31339 · ARM Trusted Firmware in AMD Zynq UltraScale+ MPSoC/RFSoCMedium
• AMD Secure Processor bootloader - legacy recovery mode: Insufficient input sanitisation in the ASP bootloader's legacyCVE-2025-29949 · AMD Secure Processor bootloader - legacy recovery modeMedium
• Junos OS Evolved: OS command injection in the CLI lets a low-privileged operator escalateCVE-2025-60006 · Juniper Junos OS Evolved (CLI command option handling)Medium