CVE-2023-38587 is a high severity (CVSS 7.5) improper input validation flaw in some Intel NUC BIOS firmware, where a privileged local user may escalate privilege. Intel's advisory INTEL-SA-01028 holds the fixed BIOS versions, which I could not load, so check it for your model.
What's affected
The affected products are some Intel NUC BIOS firmware images. The record lists NUC 8 Home models NUC8i3BEH and NUC8i5BEH with BIOS version BECFL357.0095 in its configuration data, but the description says only some Intel NUC BIOS firmware, so other models may be in scope. The weakness is improper input validation. The record says it may allow a privileged user to potentially enable escalation of privilege through local access. The record is dated 2024-01-19 and scores 7.5, High, with the vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.
The record references Intel advisory INTEL-SA-01028. Intel's site refused my request, so I cannot name fixed BIOS versions. The advisory lists affected models and the BIOS release that fixes each one. The attacker needs high privileges already and local access, which is why the complexity is rated high.
Weakness class: CWE-20.
How to check if you're exposed
Read the current BIOS version.
On Windows:
wmic bios get smbiosbiosversion
On Linux:
sudo dmidecode -s bios-version
Compare the result with the fixed BIOS version that Intel lists for your exact NUC model in the advisory. NUC models are often used as thin clients, kiosks and lab machines, which may be outside the main patching process.
What to do now
- Inventory Intel NUC devices, including kiosks and lab machines, with their model and BIOS version.
- Open INTEL-SA-01028 and find your model's fixed BIOS version.
- Update the BIOS using Intel's or the device maker's documented method.
- Limit who holds administrator rights on these devices.
- Record BIOS versions in your asset inventory so future firmware advisories can be matched quickly.
Why it matters
Firmware runs below the operating system, so a flaw there can survive a reinstall and can give control over security features the operating system relies on. The vector's Changed scope reflects that an issue in the BIOS can affect things beyond the BIOS itself.
Improper input validation means the firmware accepts a value it should have checked, usually from a setting or a call made by the operating system. Because the attacker needs high privilege first, the main risk is after another compromise. Firmware updates are routinely skipped, so track them deliberately. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Improper input validation means the product accepts data without confirming it has the properties the code assumes. Many other weaknesses start here. The defence is to validate type, length and range at the boundary and to treat everything from outside the trust boundary as untrusted.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
Which BIOS version fixes it?
Intel's advisory lists it per model. I could not load the advisory, so read it for your model.
Why is firmware worth patching if the attacker needs admin rights?
Firmware flaws can persist across reinstalls and weaken protections the operating system depends on.
Sources
Last reviewed: 19 October 2026.
