CVE-2025-35999 is a vulnerability discovered in the System Firmware Update Utility (SysFwUpdt) used on Intel Server Boards and Intel Server Systems prior to version 16.0.12. The issue stems from incorrect permission assignments on critical resources within the utility, which operates in Ring 3 (user space). This misconfiguration allows a system software adversary who already has privileged user access (e.g., administrator or root) to escalate their privileges further, potentially gaining higher-level control over the system firmware update process. The attack complexity is low, requiring only passive user interaction and no specialized internal knowledge, but it does require local access and a privileged user context. The vulnerability impacts confidentiality, integrity, and availability of the system at a high level, meaning an attacker could potentially manipulate firmware update processes, leading to unauthorized firmware modifications, system compromise, or denial of service. The CVSS 4.0 vector indicates local attack vector (AV:L), low attack complexity (AC:L), privileges required are high (PR:H), partial user interaction (UI:P), and high impact on confidentiality, integrity, and availability (VC:H, VI:H, VA:H). No known exploits have been reported in the wild, but the risk remains significant for environments relying on affected Intel server hardware and firmware update utilities. The vulnerability is particularly concerning because firmware-level compromise can lead to persistent and stealthy attacks that are difficult to detect and remediate.

The vulnerability allows a privileged local attacker to escalate privileges further, potentially gaining unauthorized control over the firmware update process. This can lead to severe consequences including unauthorized firmware modifications, persistent malware implants at the firmware level, and disruption or denial of service of critical server functions. The high impact on confidentiality means sensitive data could be exposed or manipulated. High integrity impact implies attackers could alter system firmware or configurations, undermining trust in system operations. High availability impact suggests attackers could disrupt server availability, affecting business continuity. Organizations relying on Intel server platforms with the vulnerable utility are at risk of advanced persistent threats and firmware-level compromises, which are notoriously difficult to detect and remediate. This could affect data centers, cloud providers, and enterprises with critical infrastructure, potentially leading to significant operational and reputational damage.

1. Immediately update the System Firmware Update Utility (SysFwUpdt) to version 16.0.12 or later, as provided by Intel, to remediate the incorrect permission assignments. 2. Restrict local privileged user access to only trusted personnel and enforce strict access controls and auditing on systems running the vulnerable utility. 3. Implement robust endpoint detection and response (EDR) solutions capable of monitoring firmware update activities and detecting anomalous behavior. 4. Employ firmware integrity verification tools and secure boot mechanisms to detect unauthorized firmware modifications. 5. Regularly review and harden system permissions and user roles to minimize the number of users with high privileges. 6. Conduct periodic security assessments and penetration testing focused on firmware update processes and privilege escalation vectors. 7. Maintain comprehensive logging of firmware update utility usage and monitor for unusual or unauthorized attempts. 8. Educate system administrators about the risks of privilege escalation vulnerabilities and the importance of timely patching and access control.