Server Board D50DNP/M50FCP UEFI: Out-of-bounds write enables privilege escalation
Summary
An out-of-bounds write in the XmlCliCommonDxe component of the UEFI firmware on Intel Server Boards D50DNP and M50FCP can allow privilege escalation. An attacker needs local access, high privileges, and a high-complexity attack setup, such as a malicious startup code or SMM component. Successful exploitation can lead to local code execution with high impact on confidentiality, integrity and availability. Intel's download pages state that these server families no longer receive updates after October 15, 2026.
Affected
- Intel Server Board D50DNP UEFI firmware before R01.02.0006
- Intel Server Board M50FCP UEFI firmware before R01.02.0006
Fixed in
- UEFI firmware R01.02.0006 or later (per Intel advisory INTEL-SA-01554)
- Intel's download pages state that no updates are provided after October 15, 2026
Workaround
Unknown.
- Restrict local and administrative access to the servers, including BMC and firmware update paths.
Exploitation
- Exploited in the wild: Not found.
- Public proof of concept: Not found.
- No CISA KEV entry found at the time of research; re-check before relying on this.
Our recommendation
- Check whether the servers use Intel Server Board D50DNP or M50FCP and record their UEFI version.
- Update to UEFI R01.02.0006 or later where possible.
- Because Intel no longer provides updates for these families, plan replacement or isolation of remaining systems.
- Restrict local and administrative access to these servers, including BMC and firmware update paths.
- Monitor for unexpected firmware changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01554 intel.com
- Intel BIOS and Firmware Update Package for D50DNP Family www.intel.com
- Intel BIOS and Firmware Update Package for M50FCP Family www.intel.com
- Intel M50FCP Family support page www.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 19:24.
Original description (NVD)
Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.