7

CVE-2020-27212

STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP) can be degraded from RDP level 2 (no access via debug interface) to level 1 (limited access via debug interface) by injecting a fault during the boot phase.

Data is provided by the National Vulnerability Database (NVD)
St ≫ Stm32cubel4 Firmware Version <= 1.16.0
   St ≫ Stm32l412c8 Version-
   St ≫ Stm32l412cb Version-
   St ≫ Stm32l412k8 Version-
   St ≫ Stm32l412kb Version-
   St ≫ Stm32l412r8 Version-
   St ≫ Stm32l412rb Version-
   St ≫ Stm32l412t8 Version-
   St ≫ Stm32l412tb Version-
   St ≫ Stm32l422cb Version-
   St ≫ Stm32l422kb Version-
   St ≫ Stm32l422rb Version-
   St ≫ Stm32l422tb Version-
   St ≫ Stm32l431cb Version-
   St ≫ Stm32l431cc Version-
   St ≫ Stm32l431kb Version-
   St ≫ Stm32l431kc Version-
   St ≫ Stm32l431rb Version-
   St ≫ Stm32l431rc Version-
   St ≫ Stm32l431vc Version-
   St ≫ Stm32l432kb Version-
   St ≫ Stm32l432kc Version-
   St ≫ Stm32l433cb Version-
   St ≫ Stm32l433cc Version-
   St ≫ Stm32l433rb Version-
   St ≫ Stm32l433rc Version-
   St ≫ Stm32l433vc Version-
   St ≫ Stm32l442kc Version-
   St ≫ Stm32l443cc Version-
   St ≫ Stm32l443rc Version-
   St ≫ Stm32l443vc Version-
   St ≫ Stm32l451cc Version-
   St ≫ Stm32l451ce Version-
   St ≫ Stm32l451rc Version-
   St ≫ Stm32l451re Version-
   St ≫ Stm32l451vc Version-
   St ≫ Stm32l451ve Version-
   St ≫ Stm32l452cc Version-
   St ≫ Stm32l452ce Version-
   St ≫ Stm32l452rc Version-
   St ≫ Stm32l452re Version-
   St ≫ Stm32l452vc Version-
   St ≫ Stm32l452ve Version-
   St ≫ Stm32l462ce Version-
   St ≫ Stm32l462re Version-
   St ≫ Stm32l462ve Version-
   St ≫ Stm32l471qe Version-
   St ≫ Stm32l471qg Version-
   St ≫ Stm32l471re Version-
   St ≫ Stm32l471rg Version-
   St ≫ Stm32l471ve Version-
   St ≫ Stm32l471vg Version-
   St ≫ Stm32l471ze Version-
   St ≫ Stm32l471zg Version-
   St ≫ Stm32l475rc Version-
   St ≫ Stm32l475re Version-
   St ≫ Stm32l475rg Version-
   St ≫ Stm32l475vc Version-
   St ≫ Stm32l475ve Version-
   St ≫ Stm32l475vg Version-
   St ≫ Stm32l476je Version-
   St ≫ Stm32l476jg Version-
   St ≫ Stm32l476me Version-
   St ≫ Stm32l476mg Version-
   St ≫ Stm32l476qe Version-
   St ≫ Stm32l476qg Version-
   St ≫ Stm32l476rc Version-
   St ≫ Stm32l476re Version-
   St ≫ Stm32l476rg Version-
   St ≫ Stm32l476vc Version-
   St ≫ Stm32l476ve Version-
   St ≫ Stm32l476vg Version-
   St ≫ Stm32l476ze Version-
   St ≫ Stm32l476zg Version-
   St ≫ Stm32l486jg Version-
   St ≫ Stm32l486qg Version-
   St ≫ Stm32l486rg Version-
   St ≫ Stm32l486vg Version-
   St ≫ Stm32l486zg Version-
   St ≫ Stm32l496ae Version-
   St ≫ Stm32l496ag Version-
   St ≫ Stm32l496qe Version-
   St ≫ Stm32l496qg Version-
   St ≫ Stm32l496re Version-
   St ≫ Stm32l496rg Version-
   St ≫ Stm32l496ve Version-
   St ≫ Stm32l496vg Version-
   St ≫ Stm32l496wg Version-
   St ≫ Stm32l496ze Version-
   St ≫ Stm32l496zg Version-
   St ≫ Stm32l4a6ag Version-
   St ≫ Stm32l4a6qg Version-
   St ≫ Stm32l4a6rg Version-
   St ≫ Stm32l4a6vg Version-
   St ≫ Stm32l4a6zg Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.1% 0.274
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7 1 5.9
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.4 3.4 6.4
AV:L/AC:M/Au:N/C:P/I:P/A:P
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

https://eprint.iacr.org/2021/640
Third Party Advisory