Fault Injection Vulnerability in Espressif ESP-IDF Products
CVE-2019-15894

6.8MEDIUM

Key Information:

Vendor

Espressif

Status
Esp-idf
Vendor
CVE Published:
7 October 2019

What is CVE-2019-15894?

A vulnerability in Espressif ESP-IDF allows attackers to use fault injection techniques to disrupt the ESP32 CPU, enabling them to bypass Secure Boot and execute unverified code from flash memory. Although the presence of Flash Encryption can mitigate the risks when configured correctly, disabling it opens the door for arbitrary code execution. To enhance security, it is essential for devices to implement a firmware change that ensures Flash Encryption is permanently enabled if it has not been already, thereby reducing potential exposure to such attacks.

References

https://www.espressif.com/en/news/Espressif_Security_Advi...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.