7.8

CVE-2022-22819

Exploit
NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted unsigned update.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nxp ≫ Lpc55s66jbd64 Firmware Version -
   Nxp ≫ Lpc55s66jbd64 Version -
Nxp ≫ Lpc55s66jbd100 Firmware Version -
   Nxp ≫ Lpc55s66jbd100 Version -
Nxp ≫ Lpc55s66jev98 Firmware Version -
   Nxp ≫ Lpc55s66jev98 Version -
Nxp ≫ Lpc55s69jbd64 Firmware Version -
   Nxp ≫ Lpc55s69jbd64 Version -
Nxp ≫ Lpc55s69jbd100 Firmware Version -
   Nxp ≫ Lpc55s69jbd100 Version -
Nxp ≫ Lpc55s69jev98 Firmware Version -
   Nxp ≫ Lpc55s69jev98 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.4% 0.701
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

https://www.nxp.com
Vendor Advisory
https://oxide.computer/blog/another-vulnerability-in-the-lpc55s69-rom
Third Party Advisory
Exploit