dbcve.org
Lapqc71a FirmwareOperating system · Intel

CVE-2022-34147

HIGH · 7.8 CVSS v3.1 Published 2023-05-10
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
80/100
Remediation priority · High
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Improper input validation in BIOS firmware for some Intel(R) NUC 9 Extreme Laptop Kits, Intel(R) NUC Performance Kits, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, and Intel(R) NUC Compute Element may allow a privileged user to potentially enable escalation of privilege via local access.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Improper input validation in the BIOS firmware of various Intel NUC products (laptop kits, performance kits, compute elements, pro kits and boards) allows a privileged local user to potentially escalate their privileges. This is a firmware-level vulnerability requiring local access to exploit.

MitigationApply the Intel BIOS firmware update for affected NUC products. Verify the specific model numbers against Intel's product security advisories and apply the corresponding BIOS version.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Lapqc71a FirmwareOperating system
Affected:< qccfl357.0158
Lapqc71b FirmwareOperating system
Affected:< qccfl357.0158
Lapqc71c FirmwareOperating system
Affected:< qccfl357.0158
Lapqc71d FirmwareOperating system
Affected:< qccfl357.0158
Nuc10i3fnh FirmwareOperating system
Affected:< fncml357.0059
Nuc10i3fnhf FirmwareOperating system
Affected:< fncml357.0059
Nuc10i3fnhfa FirmwareOperating system
Affected:< fncml357.0059
Nuc10i3fnhja FirmwareOperating system
Affected:< fncml357.0059

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the Intel NUC model
    Locate the product label on the NUC chassis or check the system documentation. Common identifiers include the model number (e.g., Nuc10i3fnh) or the BIOS/board name (e.g., Lapqc71a). On Linux, run 'dmidecode -s system-product-name'; on Windows, check System Information (msinfo32) under 'System Model' or 'BaseBoard Product'.
    Affected if The model matches one of the affected products listed in the CVE (Lapqc71a/b/c/d or Nuc10i3fnh variants).
  2. Retrieve the current BIOS firmware version
    On Linux, run 'dmidecode -s bios-version'. On Windows, run 'wmic bios get smbiosbiosversion' or open msinfo32 and look at 'BIOS Version'. Alternatively, boot into the NUC BIOS setup (press F2 during POST) and check the BIOS version displayed on the main screen.
    Affected if The reported BIOS version is below qccfl357.0158 (for Lapqc71 models) or below fncml357.0059 (for Nuc10i3 models).
  3. Confirm the version comparison logic
    Compare your extracted firmware version string to the fixed version threshold. Note that version comparison should treat the version as a whole string (e.g., qccfl357.0057 is less than qccfl357.0158 because 0057 < 0158 numerically).
    Affected if The installed version string is lexicographically or numerically lower than the fixed version for your specific model.

You are affected if your Intel NUC model matches one of the listed variants AND your installed BIOS firmware version is lower than qccfl357.0158 (for Lapqc71 models) or fncml357.0059 (for Nuc10i3 models).

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply the Intel BIOS firmware update for affected NUC products. Verify the specific model numbers against Intel's product security advisories and apply the corresponding BIOS version.

Recommended fix High confidence

Lapqc71a/b/c/d: BIOS firmware qccfl357.0158 or later; Nuc10i3fnh/fnhf/fnhfa/fnhja: BIOS firmware fncml357.0059 or later

  1. Identify the specific Intel NUC or Compute Element model from the affected products list (Lapqc71a/b/c/d or Nuc10i3fnh/fnhf/fnhfa/fnhja)
  2. Navigate to Intel's support website (intel.com/support) and search for the specific model number
  3. Locate the BIOS/firmware download section for the identified model
  4. Download the latest BIOS firmware version: qccfl357.0158 or higher for Lapqc71x models; fncml357.0059 or higher for Nuc10i3x models
  5. Review the BIOS update instructions provided by Intel on the download page
  6. Follow the standard BIOS update process - typically involves running the BIOS update utility or flashing from a USB drive while the system is powered on
  7. Allow the BIOS update to complete without interruption - do not power off the system during the flashing process
  8. Verify the installed BIOS version matches the expected fixed version after update
Caveat BIOS firmware updates carry a risk of system damage if interrupted; ensure stable power and follow update instructions precisely

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Lapqc71a Firmware Scoped from the published advisory
  • Consultation3.0 h
  • Implementation2.0 h
  • Testing2.0 h
  • Review / QA1.0 h
8.0 hours of engineering $1,440
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,304.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-34147 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-34147 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data