CVE-2017-5689
CriticalExploitedPublic exploitAn unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM).
Published May 2, 2017 · Updated Apr 22, 2026
Key Facts
Patch immediately- CVE-2017-5689 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Proliant Ml10 Gen9 Server Firmware (Hpe), Active Management Technology Firmware (Intel), Simatic Field Pg M3 Firmware (Siemens) and 22 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Aug 17, 2021. Public exploit code is available.
- EPSS estimates a 92% probability of exploitation in the next 30 days.
- Fixed versions are available, including Simatic Field Pg M3 Firmware 6.2.61.3535, Simatic Field Pg M4 Firmware 18.01.06, Simatic Field Pg M5 Firmware 22.01.03.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
92%
Higher than 99.8% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2017-5689 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Jan 28, 2022 | Jul 28, 2022 | Not reported |
| Industry KEV feed | Aug 17, 2021 | Jul 28, 2022 | Not reported |
| CIRCL KEV | Jan 28, 2022 | Jul 28, 2022 | Not reported |
| ENISA EUVD | Jan 28, 2022 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
52 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Proliant Ml10 Gen9 Server FirmwareHpe | 5.0 | n/a |
| Active Management Technology FirmwareIntel | 10.0, 11.0, 11.5, 11.6, 6.0, 6.1, 6.2, 7.0 | n/a |
| Simatic Field Pg M3 FirmwareSiemens | See advisory | 6.2.61.3535 |
| Simatic Field Pg M4 FirmwareSiemens | See advisory | 18.01.06 |
| Simatic Field Pg M5 FirmwareSiemens | See advisory | 22.01.03 |
Patched Releases
Simatic Field Pg M3 Firmware
6.2.61.3535
Simatic Field Pg M4 Firmware
18.01.06
Simatic Field Pg M5 Firmware
22.01.03
Simatic Ipc427e Firmware
21.01.05
Simatic Ipc477e Firmware
21.01.05
Simatic Ipc547d Firmware
7.1.91.3272
Simatic Ipc547e Firmware
9.1.41.3024
Simatic Ipc547g Firmware
11.0.26.3000
Simatic Ipc627c Firmware
6.2.61.3535
Simatic Ipc627d Firmware
9.1.41.3024
Simatic Ipc647c Firmware
6.2.61.3535
Simatic Ipc647d Firmware
9.1.41.3024
Simatic Ipc677c Firmware
6.2.61.3535
Simatic Ipc677d Firmware
9.1.41.3024
Simatic Ipc827c Firmware
6.2.61.3535
Simatic Ipc827d Firmware
9.1.41.3024
Simatic Ipc847c Firmware
6.2.61.3535
Simatic Ipc847d Firmware
9.1.41.3024
Simatic Itp1000 Firmware
9.1.41.3024
Simatic Pcs 7 Ipc427e Firmware
21.01.04
siemens simatic pcs 7 ipc547d firmware
7.1.91.3272
siemens simatic pcs 7 ipc547e firmware
9.1.41.3024
siemens simatic pcs 7 ipc547g firmware
11.0.26.3000
siemens simatic pcs 7 ipc627c firmware
6.2.61.3535
siemens simatic pcs 7 ipc647c firmware
6.2.61.3535
Timeline
Publicly disclosed
May 2, 2017
Added to Industry KEV feed
Aug 17, 2021
Added to CISA KEV
Jan 28, 2022
Added to CIRCL KEV
Jan 28, 2022
Added to ENISA EUVD
Jan 28, 2022
Last updated
Apr 22, 2026
Weakness Type
- CWE-269 Improper Privilege Management
References
- advisoryhttps://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf
- advisoryhttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us
- advisoryhttps://security.netapp.com/advisory/ntap-20170509-0001/
- advisoryhttps://www.embedi.com/news/mythbusters-cve-2017-5689
- advisoryhttps://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
FAQ
Common Questions.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM).
Affected: Proliant Ml10 Gen9 Server Firmware (Hpe) versions 5.0; Active Management Technology Firmware (Intel) versions 10.0, 11.0, 11.5, 11.6, 6.0, 6.1, 6.2, 7.0; Simatic Field Pg M3 Firmware (Siemens), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Aug 17, 2021.
Yes. It was added on Jan 28, 2022 with a federal remediation due date of Jul 28, 2022.
Public exploit code is available.
Fixed versions are available, including Simatic Field Pg M3 Firmware 6.2.61.3535, Simatic Field Pg M4 Firmware 18.01.06, Simatic Field Pg M5 Firmware 22.01.03.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2017-5689 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo