7

CVE-2020-27212

STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP) can be degraded from RDP level 2 (no access via debug interface) to level 1 (limited access via debug interface) by injecting a fault during the boot phase.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
St ≫ Stm32cubel4 Firmware Version <= 1.16.0
   St ≫ Stm32l412c8 Version -
   St ≫ Stm32l412cb Version -
   St ≫ Stm32l412k8 Version -
   St ≫ Stm32l412kb Version -
   St ≫ Stm32l412r8 Version -
   St ≫ Stm32l412rb Version -
   St ≫ Stm32l412t8 Version -
   St ≫ Stm32l412tb Version -
   St ≫ Stm32l422cb Version -
   St ≫ Stm32l422kb Version -
   St ≫ Stm32l422rb Version -
   St ≫ Stm32l422tb Version -
   St ≫ Stm32l431cb Version -
   St ≫ Stm32l431cc Version -
   St ≫ Stm32l431kb Version -
   St ≫ Stm32l431kc Version -
   St ≫ Stm32l431rb Version -
   St ≫ Stm32l431rc Version -
   St ≫ Stm32l431vc Version -
   St ≫ Stm32l432kb Version -
   St ≫ Stm32l432kc Version -
   St ≫ Stm32l433cb Version -
   St ≫ Stm32l433cc Version -
   St ≫ Stm32l433rb Version -
   St ≫ Stm32l433rc Version -
   St ≫ Stm32l433vc Version -
   St ≫ Stm32l442kc Version -
   St ≫ Stm32l443cc Version -
   St ≫ Stm32l443rc Version -
   St ≫ Stm32l443vc Version -
   St ≫ Stm32l451cc Version -
   St ≫ Stm32l451ce Version -
   St ≫ Stm32l451rc Version -
   St ≫ Stm32l451re Version -
   St ≫ Stm32l451vc Version -
   St ≫ Stm32l451ve Version -
   St ≫ Stm32l452cc Version -
   St ≫ Stm32l452ce Version -
   St ≫ Stm32l452rc Version -
   St ≫ Stm32l452re Version -
   St ≫ Stm32l452vc Version -
   St ≫ Stm32l452ve Version -
   St ≫ Stm32l462ce Version -
   St ≫ Stm32l462re Version -
   St ≫ Stm32l462ve Version -
   St ≫ Stm32l471qe Version -
   St ≫ Stm32l471qg Version -
   St ≫ Stm32l471re Version -
   St ≫ Stm32l471rg Version -
   St ≫ Stm32l471ve Version -
   St ≫ Stm32l471vg Version -
   St ≫ Stm32l471ze Version -
   St ≫ Stm32l471zg Version -
   St ≫ Stm32l475rc Version -
   St ≫ Stm32l475re Version -
   St ≫ Stm32l475rg Version -
   St ≫ Stm32l475vc Version -
   St ≫ Stm32l475ve Version -
   St ≫ Stm32l475vg Version -
   St ≫ Stm32l476je Version -
   St ≫ Stm32l476jg Version -
   St ≫ Stm32l476me Version -
   St ≫ Stm32l476mg Version -
   St ≫ Stm32l476qe Version -
   St ≫ Stm32l476qg Version -
   St ≫ Stm32l476rc Version -
   St ≫ Stm32l476re Version -
   St ≫ Stm32l476rg Version -
   St ≫ Stm32l476vc Version -
   St ≫ Stm32l476ve Version -
   St ≫ Stm32l476vg Version -
   St ≫ Stm32l476ze Version -
   St ≫ Stm32l476zg Version -
   St ≫ Stm32l486jg Version -
   St ≫ Stm32l486qg Version -
   St ≫ Stm32l486rg Version -
   St ≫ Stm32l486vg Version -
   St ≫ Stm32l486zg Version -
   St ≫ Stm32l496ae Version -
   St ≫ Stm32l496ag Version -
   St ≫ Stm32l496qe Version -
   St ≫ Stm32l496qg Version -
   St ≫ Stm32l496re Version -
   St ≫ Stm32l496rg Version -
   St ≫ Stm32l496ve Version -
   St ≫ Stm32l496vg Version -
   St ≫ Stm32l496wg Version -
   St ≫ Stm32l496ze Version -
   St ≫ Stm32l496zg Version -
   St ≫ Stm32l4a6ag Version -
   St ≫ Stm32l4a6qg Version -
   St ≫ Stm32l4a6rg Version -
   St ≫ Stm32l4a6vg Version -
   St ≫ Stm32l4a6zg Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.259
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7 1 5.9
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 4.4 3.4 6.4
AV:L/AC:M/Au:N/C:P/I:P/A:P
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

https://www.aisec.fraunhofer.de/en/FirmwareProtection.html
Third Party Advisory
https://eprint.iacr.org/2021/640
Third Party Advisory
https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.html
Third Party Advisory