Insufficient Validation Vulnerability in Espressif ESP-IDF Products

CVE-2018-18558

What is CVE-2018-18558?

An issue in earlier versions of Espressif's ESP-IDF allows a local attacker to bypass secure boot protections due to insufficient validation of input data in the 2nd stage bootloader. This vulnerability gives an attacker the ability to execute arbitrary code by crafting a malicious application binary that overwrites a bootloader code segment, particularly when flash encryption is disabled or when the attacker exploits additional vulnerabilities to write the binary to flash memory.

References