{"id":"CVE-2026-18349","state":"PUBLISHED","title":"SAMA5D44 Fault Injection Vulnerability","description":"Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection.\n\nThis issue affects SAMA5D4.","publishedAt":"2026-08-24T16:07:45.500Z","updatedAt":"2026-10-27T16:40:02.564Z","severity":{"score":7.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","source":"Microchip"},"assigner":"Microchip","products":["Microchip SAMA5D4"],"affected":[{"vendor":"Microchip","product":"SAMA5D4","defaultStatus":"affected","versions":[{"version":"0","status":"affected"}]}],"references":["https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/sama5d44-fault-injection-vulnerability"],"weaknesses":["CWE-1247"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/18xxx/CVE-2026-18349.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-18349","state":"PUBLISHED","datePublished":"2026-08-24T16:07:45.500Z","dateUpdated":"2026-10-27T16:40:02.564Z","assignerShortName":"Microchip","assignerOrgId":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","dateReserved":"2026-07-30T05:06:19.951Z"},"containers":{"cna":{"title":"SAMA5D44 Fault Injection Vulnerability","descriptions":[{"lang":"en","value":"Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection.\n\nThis issue affects SAMA5D4."}],"affected":[{"vendor":"Microchip","product":"SAMA5D4","defaultStatus":"affected","versions":[{"version":"0","status":"affected"}]}],"references":[{"url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/sama5d44-fault-injection-vulnerability"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"PHYSICAL","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.3,"vectorString":"CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1247","lang":"en","description":"CWE-1247 Improper protection against voltage and clock glitches","type":"CWE"}]}],"providerMetadata":{"shortName":"Microchip","orgId":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","dateUpdated":"2026-10-27T16:40:02.564Z"},"impacts":[{"capecId":"CAPEC-624","descriptions":[{"lang":"en","value":"CAPEC-624 Hardware Fault Injection"}]}],"configurations":[{"lang":"en","value":"Access to the VCC_CORE pin.","supportingMedia":[{"type":"text/html","base64":false,"value":"Access to the VCC_CORE pin."}]}],"solutions":[{"lang":"en","value":"Because this attack requires direct physical access to the device’s core power supply, the most effective protection is to prevent such access. Customers deploying the SAMA5D4 in security-sensitive applications should review the physical-security assumptions of their deployment and consider measures that make the core supply rail physically inaccessible.  This includes avoiding exposed test points or headers on that rail and employing mechanical protections such as potting, conformal coating, shielding, or tamper-resistant enclosures to prevent attachment of fault-injection equipment.","supportingMedia":[{"type":"text/html","base64":false,"value":"Because this attack requires direct physical access to the device’s core power supply, the most effective protection is to prevent such access. Customers deploying the SAMA5D4 in security-sensitive applications should review the physical-security assumptions of their deployment and consider measures that make the core supply rail physically inaccessible.  This includes avoiding exposed test points or headers on that rail and employing mechanical protections such as potting, conformal coating, shielding, or tamper-resistant enclosures to prevent attachment of fault-injection equipment."}]}],"timeline":[{"time":"2026-07-06T07:00:00.000Z","lang":"en","value":"Reported"}],"credits":[{"lang":"en","value":"Vladimir Kononovich","type":"finder"}],"source":{"advisory":"PSIRT-151","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-24T20:17:41.440102Z","id":"CVE-2026-18349","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-24T20:18:42.750Z"}}]}}}