Only by a physical person. Otherwise it's not an airgapped network.
Intel Management Engine - https://en.wikipedia.org/wiki/Intel_Management_Engine
"Several weaknesses have been found in the ME. On May 1, 2017, Intel confirmed a Remote Elevation of Privilege bug (SA-00075) in its Management Technology.[36] Every Intel platform with provisioned Intel Standard Manageability, Active Management Technology, or Small Business Technology, from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME"
https://www.intel.com/content/www/us/en/developer/tools/in-b...
1- "...The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off..."
2- The Intel Management Engine is the remote privilege escalation.(Read on the known and unpublished vulnerabilities).
3- Over-the-Air Firmware Updates...
If I say more we both will end on a secure facility.
Mate I feel like you're getting your security know-how from watching Mission Impossible.
"Over-the-Air" doesn't actually mean you can magically beam SW updates wirelessly through the air to the Intel chip like in the hacker/spy movies, as airgapped networks, as per name, don't have wireless cards.
Intel ME still requires a network connection to the internet/network from which you want to apply the update. If you're on an airgapped network this becomes impossible to do without first breaching the airgapped network physicality, but this is not what happened according to the article, they just compromised some employee Microsoft/O365 account which is on the less secure network anyway and probably stole whatever IP they could find shared through the e-mail accounts and on Sharepoint.
If you have a wireless card then your system was never airgapped to begin with. Parent makes some wild confusions.
Is dismounting your Motherboard what you mean by not having a card?
That's just the wireless controller on the chip but its not enough to have wireless communication actually work. You still need a wireless PHY which modulates the digital signal into radio waves, and an antennae attached to actually have wifi. On it's on it does nothing, it's just a piece of silicon that can't achieve radio communication.
"AIR-FI: Generating Covert Wi-Fi Signals from Air-Gapped Computers" - https://arxiv.org/abs/2012.06884
"In this paper, we show that attackers can exfiltrate data from air-gapped computers via Wi-Fi signals. Malware in a compromised air-gapped computer can generate signals in the Wi-Fi frequency bands. The signals are generated through the memory buses - no special hardware is required."
The notion that I am going to establish any kind of foothold in your system that's properly air gapped via TEMPEST is silly.
But, more importantly, the IME needs to be able to receive a signal to update, not transmit.
And to the IoT reference - such a computer wouldn't be (or rather shouldn't be) regarded as airgapped.
If you do add an antenna to your 'airgapped' computer, well, just don't.
Is there a third way?