Skip to main content

CVE-2025-22848: Denial of Service in Edge Orchestrator software for Intel(R) Tiber™ Edge Platform

Medium
VulnerabilityCVE-2025-22848cvecve-2025-22848
Published: Tue May 13 2025 (05/13/2025, 21:02:43 UTC)
Source: CVE
Vendor/Project: n/a
Product: Edge Orchestrator software for Intel(R) Tiber™ Edge Platform

Description

Improper conditions check for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.

AI-Powered Analysis

AILast updated: 07/06/2025, 16:13:10 UTC

Technical Analysis

CVE-2025-22848 is a medium-severity vulnerability identified in the Edge Orchestrator software component of the Intel(R) Tiber™ Edge Platform. The vulnerability arises due to improper condition checks within the software, which can be exploited by an authenticated user with adjacent network access to trigger a denial of service (DoS) condition. Specifically, the flaw allows a user with limited privileges (low privileges) and no user interaction to disrupt the availability of the Edge Orchestrator service. The CVSS 4.0 vector indicates that the attack requires adjacent network access (AV:A), low attack complexity (AC:L), no privileges required (PR:L), no user interaction (UI:N), and impacts only the availability (VA:L) of the system. The vulnerability does not affect confidentiality or integrity and does not require physical or local access. The Edge Orchestrator software is a critical component for managing and orchestrating edge computing resources on the Intel Tiber Edge Platform, which is designed for distributed computing environments often used in industrial, telecommunications, and enterprise edge deployments. The flaw could cause service interruptions, potentially impacting the orchestration and management of edge workloads and devices.

Potential Impact

For European organizations deploying the Intel Tiber Edge Platform, particularly those relying on edge computing for critical infrastructure, telecommunications, manufacturing automation, or smart city applications, this vulnerability poses a risk of service disruption. A denial of service in the Edge Orchestrator could lead to temporary loss of control over edge devices, delayed processing of edge workloads, and potential cascading effects on dependent systems. While the vulnerability does not compromise data confidentiality or integrity, the availability impact could affect operational continuity, especially in environments where edge orchestration is pivotal for real-time processing and decision-making. Organizations in sectors such as energy, transportation, and industrial automation, which increasingly adopt edge computing, may experience operational delays or outages if exploited. The requirement for adjacent network access and authenticated user privileges somewhat limits the attack surface, but insider threats or compromised internal devices could still exploit this vulnerability.

Mitigation Recommendations

To mitigate CVE-2025-22848, European organizations should first ensure that all Edge Orchestrator software instances on the Intel Tiber Edge Platform are updated to the latest patched versions once available from Intel. Until patches are released, organizations should implement strict network segmentation to limit adjacent network access to the Edge Orchestrator components, restricting access only to trusted and authenticated users and devices. Employing robust authentication mechanisms and monitoring for unusual access patterns can help detect potential exploitation attempts. Additionally, organizations should enforce the principle of least privilege for users with access to the Edge Orchestrator, minimizing the number of users who can authenticate and interact with the system. Regularly auditing and hardening the edge network environment, including disabling unnecessary services and ports, will further reduce the risk. Implementing redundancy and failover mechanisms for edge orchestration services can help maintain availability in case of a DoS event.

Need more detailed analysis?Get Pro

Technical Details

Data Version
5.1
Assigner Short Name
intel
Date Reserved
2025-01-09T04:00:22.743Z
Cisa Enriched
true
Cvss Version
4.0
State
PUBLISHED

Threat ID: 682cd0fb1484d88663aecabe

Added to database: 5/20/2025, 6:59:07 PM

Last enriched: 7/6/2025, 4:13:10 PM

Last updated: 8/12/2025, 7:55:47 PM

Views: 18

Actions

PRO

Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.

Please log in to the Console to use AI analysis features.

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats