← Back

CVE-2020-13799

nvd nist
Published: Nov 18, 2020Modified: Jun 17, 2026

JSON object

Loading...
6.8
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.9 / Impact: 5.9
Source: NVD

Description

Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standards for storage device interfaces, including all versions of eMMC, UFS, and NVMe. The RPMB protocol is specified by industry standards bodies and is implemented by storage devices from multiple vendors to assist host systems in securing trusted firmware. Several scenarios have been identified in which the RPMB state may be affected by an attacker without the knowledge of the trusted component that uses the RPMB feature.

Affected (4)

Westerndigital
3 products
Inand Cl Em132 Firmware
Inand Ix Em132 Firmware
Inand Ix Em132 Xi Firmware
Trustedfirmware
1 product
Op Tee
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Inand Cl Em132 Firmware
Up to 2020-06-03
Running on/withPlatform Versions
Westerndigital
Inand Cl Em132
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Inand Ix Em132 Firmware
Up to 2020-06-03
Running on/withPlatform Versions
Westerndigital
Inand Ix Em132
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Inand Ix Em132 Xi Firmware
Up to 2020-06-03
Running on/withPlatform Versions
Westerndigital
Inand Ix Em132 Xi
All versions
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Op Tee
Up to 3.11.0

Related CWEs

CWE-294
Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

References (10)

Source: cve@mitre.org
Third Party AdvisoryUS Government Resource
Source: cve@mitre.org
Third Party AdvisoryUS Government Resource
Source: cve@mitre.org
Third Party AdvisoryUS Government Resource
Source: cve@mitre.org
Third Party AdvisoryUS Government Resource
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.