{"id":"CVE-2019-14236","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-14236","generatedAt":"2026-10-29T00:41:50.814Z","title":"On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and the effect of code/instruction execution.","description":"On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and the effect of code/instruction execution.","published":"2019-09-12T18:15:12.000Z","lastModified":"2026-06-17T02:18:01.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-863"],"affected":["st/stm32l0 firmware","st/stm32l1 firmware","st/stm32f4 firmware","st/stm32l4 firmware","st/stm32f7 firmware","st/stm32h7 firmware"],"epss":{"score":0.02261,"percentile":0.82896,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (2.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://www.usenix.org/system/files/woot19-paper_schink.pdf","tags":["Exploit","Mitigation","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.usenix.org/system/files/woot19-paper_schink.pdf","tags":["Exploit","Mitigation","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-14236","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}