CVE-2025-35969: Intel Server Firmware Update Privilege Escalation

CVE-2025-35969 Overview

CVE-2025-35969 is an uncontrolled search path vulnerability [CWE-427] affecting Intel Server Firmware Update Utility Software before version 16.0.12. The flaw resides in Ring 3 user-space components and may allow an authenticated local user to escalate privileges. Exploitation requires local access, low-privileged authentication, and active user interaction, combined with high attack complexity. A successful attack can compromise the confidentiality, integrity, and availability of the affected system. Intel published the issue under Intel Security Advisory SA-01410.

Critical Impact

An authenticated local adversary may hijack the firmware update utility's library search order to execute code with elevated privileges, compromising host confidentiality, integrity, and availability.

Affected Products

• Intel Server Firmware Update Utility Software versions prior to 16.0.12
• Intel server platforms relying on the affected firmware update tooling
• Systems where the utility is invoked by privileged users or scheduled tasks

Discovery Timeline

• 2026-05-12 - CVE-2025-35969 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2025-35969

Vulnerability Analysis

The vulnerability is classified as an uncontrolled search path element [CWE-427]. The Intel Server Firmware Update Utility loads supporting libraries or binaries without fully constraining the directories searched at load time. An attacker who can place a malicious file in a writable location appearing earlier in the search path can cause the utility to load attacker-controlled code. When the utility runs in a privileged context, that code executes with elevated rights, producing privilege escalation within Ring 3 user applications.

The scope of the flaw is bounded to the vulnerable system. The CVSS 4.0 base score of 5.4 reflects high attack complexity, the requirement for an authenticated local user, and the need for active user interaction to trigger the vulnerable code path. The EPSS probability remains very low at the time of publication, and no public proof-of-concept or in-the-wild exploitation has been reported.

Root Cause

The root cause is improper control of the search path used to resolve dependent modules. The utility relies on the operating system's default resolution order rather than explicitly pinning trusted, absolute paths for the libraries and helper executables it consumes. This allows binary planting and DLL/shared-object preloading attacks when a writable directory is present in the search order before the legitimate location.

Attack Vector

Exploitation requires local access by an authenticated user. The attacker stages a malicious library or executable matching a name the utility resolves at load time, then waits for or induces a privileged user to launch the firmware update workflow. Because user interaction is required, social engineering or co-located task scheduling is typically necessary. Once the utility loads the planted binary, the attacker's payload runs in the security context of the invoking process.

No verified public exploit code is available for CVE-2025-35969. Technical specifics are documented in the Intel Security Advisory SA-01410.

Detection Methods for CVE-2025-35969

Indicators of Compromise

• Unexpected DLL or shared object files in directories adjacent to the Intel Server Firmware Update Utility binaries
• Process creation events where the utility spawns unsigned or unexpected child processes
• Module load events resolving to user-writable directories instead of trusted system paths
• Newly written executables in temporary or staging folders immediately before utility execution

Detection Strategies

• Monitor image-load telemetry for the firmware update utility and flag modules loaded from non-standard or user-writable paths
• Hunt for file write events that drop libraries matching dependency names used by the utility
• Correlate elevated-privilege process launches of the utility with recent file activity in the same working directory
• Compare loaded module hashes against a baseline of legitimate Intel-signed binaries

Monitoring Recommendations

• Enable file integrity monitoring on directories where the firmware update utility is installed and executed
• Alert on execution of the utility from non-standard paths, especially user profile or removable media locations
• Track privileged sessions that launch firmware tooling and review interactive prompts answered by operators

How to Mitigate CVE-2025-35969

Immediate Actions Required

• Upgrade the Intel Server Firmware Update Utility Software to version 16.0.12 or later on all affected servers
• Restrict execution of the utility to administrators operating from trusted, write-protected directories
• Audit administrator workstations and server staging directories for unexpected libraries adjacent to the utility
• Remove writable entries from the system PATH for accounts that run firmware tooling

Patch Information

Intel addressed the vulnerability in version 16.0.12 of the Server Firmware Update Utility Software. Customers should follow the remediation guidance in Intel Security Advisory SA-01410 and validate that all server management workstations and out-of-band update hosts are running the fixed release.

Workarounds

• Execute the utility only from a hardened, ACL-restricted directory that non-administrators cannot write to
• Launch the utility using absolute paths rather than relying on PATH resolution
• Limit interactive use of the tool to trained operators and disable shared-session access during updates
• Apply application allowlisting to prevent unsigned libraries from loading into the utility process

# Configuration example: verify installed utility version before use
intel-sfuu --version
# Expected output: 16.0.12 or later

# Restrict execution directory permissions (Linux example)
chown root:root /opt/intel/sfuu
chmod 755 /opt/intel/sfuu
find /opt/intel/sfuu -type f -exec chmod 644 {} \;