← Back

CVE-2019-14236

nvd nist
Published: Sep 12, 2019Modified: Nov 21, 2024

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and the effect of code/instruction execution.

Affected (6)

St
6 products
Stm32l0 Firmware
Stm32l1 Firmware
Stm32f4 Firmware
Stm32l4 Firmware
Stm32f7 Firmware
Stm32h7 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Stm32l0 Firmware
All versions
Running on/withPlatform Versions
St
Stm32l0
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Stm32l1 Firmware
All versions
Running on/withPlatform Versions
St
Stm32l1
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Stm32f4 Firmware
All versions
Running on/withPlatform Versions
St
Stm32f4
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Stm32l4 Firmware
All versions
Running on/withPlatform Versions
St
Stm32l4
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Stm32f7 Firmware
All versions
Running on/withPlatform Versions
St
Stm32f7
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Stm32h7 Firmware
All versions
Running on/withPlatform Versions
St
Stm32h7
All versions

Related CWEs

CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

Source: cve@mitre.org
ExploitMitigationThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMitigationThird Party Advisory

Timeline

No history available yet.