Skip to content
CVE PROGRAM SOURCE RECORD6.7 Medium

CVE-2024-38433

Nuvoton - CWE-305: Authentication Bypass by Primary Weakness

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
INCD

Description

Nuvoton - CWE-305: Authentication Bypass by Primary Weakness An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock reference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Nuvoton NPCM7xx (Poleg) BootBlock

Default version status: unaffected

  • All versions to < v10.10.19affected

References