Intel Server Board D50DNP/M50FCP: Out-of-bounds write in UEFI XmlCliCommonDxe
Summary
An out-of-bounds write in the XmlCliCommonDxe component of the Ring 0 UEFI firmware of Intel Server Board D50DNP and M50FCP may allow privilege escalation. An attacker needs local access and already-privileged system software access, plus a high-complexity attack condition, and no user interaction is required. Successful exploitation could lead to local code execution in firmware with high impact on confidentiality, integrity and availability. Both boards are end-of-support as of 15 October 2026, so no fix may be provided.
Affected
- Intel Server Board D50DNP and Intel Server Board M50FCP (UEFI firmware)
- Exact affected versions: Unknown. The Intel advisory could not be retrieved; the CVE record lists the products as affected.
Fixed in
- Unknown. Intel's advisory INTEL-SA-01554 could not be verified.
- Intel's support pages list D50DNP BIOS/UEFI R01.02.0006 (7 July 2026) and M50FCP production BIOS R01.02.0005 or later, but these are not confirmed as fixes for this CVE.
- Both product families are end-of-support as of 15 October 2026.
Workaround
- Unknown. No vendor workaround has been identified.
Exploitation
- No information found on exploitation in the wild.
- No public proof of concept found.
- Not listed in CISA KEV as far as known.
Our recommendation
- Inventory all D50DNP and M50FCP systems now.
- Check whether the BMC is reachable from untrusted networks and restrict local administrator and BMC/Redfish access.
- Keep firmware administration credentials tightly controlled and monitor for unexpected firmware changes.
- Because the boards are end-of-support, plan replacement or isolation rather than waiting for a firmware update.
- Review Intel advisory INTEL-SA-01554 and NVD for confirmed affected and fixed versions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01554 intel.com
- Intel Support: Intel Server D50DNP family www.intel.com
- Intel Support: Intel Server M50FCP family www.intel.com
- Intel Download: M50FCP BIOS and system firmware update package www.intel.com
- Intel Security Advisory INTEL-SA-01269 (earlier, different issues) www.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 19:23.
Original description (NVD)
Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.