CVE-2017-18347
Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race…
Does this matter?
Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own.
Description
Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.
- CVSS 3.1
- 4.6 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.40% probability · 34th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362
- Affected
- st/stm32f071rb firmware · st/stm32f071v8 firmware · st/stm32f071vb firmware · st/stm32f072c8 firmware · st/stm32f072cb firmware · st/stm32f072r8 firmware · st/stm32f072rb firmware · st/stm32f072v8 firmware · st/stm32f072vb firmware · st/stm32f078cb firmware · st/stm32f078rb firmware · st/stm32f078vb firmware · st/stm32f091cb firmware · st/stm32f091cc firmware · st/stm32f091rb firmware · st/stm32f091rc firmware · st/stm32f091vb firmware · st/stm32f091vc firmware · st/stm32f098cc firmware · st/stm32f098rc firmware · +40 more
- Source
- cve@mitre.org
References
- https://community.st.com/s/question/0D50X00009Xke7aSAB/readout-protection-cracked-on-stm32Vendor Advisory
- https://www.aisec.fraunhofer.de/en/FirmwareProtection.htmlExploit, Third Party Advisory
- https://www.usenix.org/conference/woot17/workshop-program/presentation/obermaierExploit, Third Party Advisory
- https://community.st.com/s/question/0D50X00009Xke7aSAB/readout-protection-cracked-on-stm32Vendor Advisory
- https://www.aisec.fraunhofer.de/en/FirmwareProtection.htmlExploit, Third Party Advisory
- https://www.usenix.org/conference/woot17/workshop-program/presentation/obermaierExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.